desmondmaincoinbase[.]netlify[.]app

The domain desmondmaincoinbase.netlify.app was registered on March 10, 2026 and is presently taken offline. DNS resolution points to the IPv6 address 2a05:d014:58f:6200::259, which is hosted in Germany and belongs to AS16509 Amazon.com, Inc. The site is delivered through Netlify and presents an HSTS header, indicating transport‑layer security enforcement. The TLS certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, confirming a valid SSL handshake despite the site returning an HTTP 404 status with the page title "Site not found." Google Safe Browsing classifies the domain as a social‑engineering threat, and it is listed on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that 14 of 94 security vendors have flagged the domain, reinforcing its malicious reputation. The threat profile is a crypto‑related brand impersonation targeting Coinbase, as indicated by the "Impersonates: Coinbase" and "Scam type: Crypto Scam" entries. While the site currently serves no content, the infrastructure—Amazon‑hosted Netlify deployment, a legitimate‑looking DigiCert certificate, and active blocklist entries—demonstrates a deliberate attempt to exploit trust in the Coinbase brand.

Defenders should continue to block the domain at perimeter filters, monitor DNS queries for similar Netlify subdomains, and consider adding the IPv6 address to threat‑intelligence feeds. Ongoing verification of any re‑activation is advised, as the underlying hosting environment can be rapidly repurposed for future impersonation campaigns.