69af513e79d93a0cbd310dad--coinbase-clone-g4joey[.]netlify[.]app

This domain, 69af513e79d93a0cbd310dad--coinbase-clone-g4joey.netlify.app, was identified as a high-risk brand impersonation targeting Coinbase, a cryptocurrency exchange platform. Registered on March 10, 2026, through Netlify, the domain hosted a page titled 'Coinbase — Buy & Sell Cryptocurrency,' directly mimicking the legitimate Coinbase brand. Analysis indicates it was classified as a crypto scam, with Google Safe Browsing flagging it for social engineering. The domain resolved to IP 98.84.224.111, located in Germany under AS16509 (Amazon.com, Inc.), and employed an SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1).

Technologies detected include Netlify hosting and HSTS enforcement. Security vendor detections were significant: 16 of 94 engines on VirusTotal flagged the domain, while it appeared on three security blocklists and was blocked by PhishDestroy, MetaMask, and SEAL. As of July 25, 2026, the domain returned an HTTP 404 status, suggesting it has been taken offline or disabled.

Defenders should treat this domain as malicious, particularly in environments handling cryptocurrency transactions. The infrastructure and detection patterns align with known crypto scam operations, though the exact mechanics of the scam (e.g., credential harvesting, wallet drainers) remain unconfirmed due to the domain's current unavailability. Organizations are advised to block the domain, its resolved IP, and monitor for similar Netlify-hosted impersonation attempts targeting Coinbase or other financial platforms.