clinquant-yeot-a7f542[.]netlify[.]app

Analysis on July 24, 2026 indicates that the domain clinquant-yeot-a7f542.netlify.app is associated with a high‑risk crypto impersonation campaign targeting the Ethereum brand. The site resolves to the IP address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. DNS resolution is provided by nsone.net name servers dns1.p04.nsone.net and dns2.p04.nsone.net. The domain is hosted on Netlify infrastructure and presents an HSTS header, confirming the use of TLS. The presented SSL certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, a legitimate certificate authority, which does not mitigate the malicious intent.

The page title observed during the brief scan was “Pooled Staking for Ethereum - PoolStaked,” directly referencing Ethereum and suggesting a fraudulent staking service. Google Safe Browsing flags the URL for social engineering, and the domain is listed on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal records indicate that 13 of 95 scanning engines flag the site as malicious. Scamadviser assigns a trust score of 1 out of 100, reinforcing the low credibility of the domain. The HTTP response returned a 404 status, and the site is currently taken offline, limiting immediate interaction but not removing the underlying infrastructure.

The combination of brand impersonation, crypto‑scam classification, low trust score, multiple vendor detections, and blocklist presence suggests a deliberate attempt to lure victims into fraudulent Ethereum staking schemes. Defenders should continue to block the domain at network perimeter, monitor the associated IP and name‑server ranges for any re‑use, and add the domain to internal threat intelligence feeds.