site-pro-logn-protl[.]daftpage[.]com

This domain, site-pro-logn-protl.daftpage.com, is currently active and resolves to IP 216.150.16.65, hosted on Amazon AS16509 in the United States. Registration was performed through OVH, SAS on 2021-10-24. The site presents the page title “Coinbase Pro login Portal: Fast and Secure Access,” indicating a brand-impersonation attempt targeting Coinbase. Infrastructure analysis shows the site is served via Vercel with DNS records ns1.vercel-dns.com and ns2.vercel-dns.com, uses a Let’s Encrypt R13 TLS certificate, and returns HTTP 308 redirects. Detected technologies include Node.js, React, Next.js, YouTube embeds, HSTS enforcement, Google Analytics, and Crisp live‑chat widgets. Security telemetry reports 10 of 95 VirusTotal scanners flagging the domain and its inclusion on one external blocklist; Gridinsoft assigns a trust score of 0/100 and PhishDestroy has blocked it. The observed kit is classified as a seed‑phrase phishing module, consistent with the crypto‑scam classification. While the page content has not been inspected, the combination of brand‑specific page title, credential‑stealing kit, and low trust scores strongly suggests malicious intent. Defenders should block the domain at the network perimeter, update URL filtering lists, and monitor for related command‑and‑control activity. Additional investigation of inbound traffic to 216.150.16.65 is recommended to identify potential victim interactions.