sso-coinbse-cdn[.]daftpage[.]com

This domain is flagged as an active brand impersonation threat targeting Coinbase with a high risk level and confirmed presence on two security blocklists. Infrastructure analysis reveals registration through OVH SAS on October 24 2021 along with resolution to IP address 216.150.16.65 and an SSL certificate issued by Let's Encrypt. The recorded page title matches Log In | Coinbase.com — Buy and Sell Bitcoin while the site remains operational as of the July 12 2026 report date. Detection data includes a Gridinsoft trust score of 0/100 and flagging by 14 out of 95 security vendors. Technology stack indicators list Node.js React Next.js Vercel HSTS Google Analytics Crisp Live Chat and YouTube. The impersonation classification rests on the explicit brand target and page title evidence rather than visual inspection. Exact page content remains unexamined so any assumptions about login forms or credential capture mechanisms cannot be substantiated from current data. Defenders should incorporate the domain and associated IP into blocklists and endpoint controls while monitoring for similar subdomain patterns under the daftpage.com parent. Continued observation is warranted given the domain's long registration history and sustained activity despite existing blocks by PhishDestroy and PhishingDB.