conbasesupport[.]netlify[.]app

The domain conbasesupport.netlify.app is presently offline, returning an HTTP 404 status, but its historical footprint reveals a clear pattern of brand impersonation targeting Coinbase users. Infrastructure analysis shows the domain resolves to the IPv6 address 2a05:d014:58f:6200::259, which is hosted within the Amazon.com, Inc. network (AS16509) and geolocated to Germany. Registration was performed through Netlify, and the site leveraged Netlify’s hosting platform, as indicated by the detected Netlify technology stack and the presence of HTTP Strict Transport Security (HSTS). The TLS certificate in use was issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming a valid SSL chain at the time of observation.

The page title retrieved from the site, "Conbase Support | Learn About Cryptocurrency & Blockchain," mirrors the legitimate Coinbase brand and suggests an attempt to lure users seeking support for cryptocurrency services. VirusTotal scans flagged the domain by two of ninety‑five security vendors, and the site is listed on a single security blocklist, reflecting limited but notable detection. Additionally, the domain has been actively blocked by the PhishDestroy community, further corroborating its malicious intent.

While the site is no longer serving content, defenders should retain the associated indicators—IPv6 address, Netlify hosting identifiers, SSL certificate details, and the exact page title—to enrich threat intelligence feeds and enable proactive blocking. Network defenders should ensure that outbound connections to the resolved IP address are denied, monitor for any future re‑registration of similar Netlify‑hosted subdomains, and incorporate the domain name into URL filtering policies. Continuous verification against reputation services is advised, as the low detection count may evolve if the actors reactivate the site or spawn new impersonation domains.