coinbase-clone-d-codes-it[.]netlify[.]app

This domain, coinbase-clone-d-codes-it.netlify.app, is actively engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the site is designed to deceive users into believing they are interacting with legitimate Coinbase services, potentially leading to unauthorized access to sensitive financial information or cryptocurrency assets. The domain remains operational as of the latest assessment. Infrastructure analysis reveals the domain was registered through Netlify and resolves to the IP address 63.176.8.218, hosted on infrastructure associated with Amazon.com, Inc. (AS16509) in Germany. The domain was created on March 12, 2026, though this date may reflect manipulation or an error in registration records. Security vendors have flagged the domain as malicious, with 7 of 95 VirusTotal vendors detecting it as a threat. The domain appears on three security blocklists and is explicitly labeled as a phishing site by Google Safe Browsing. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the risk, as fraudulent sites commonly use valid certificates to appear legitimate. Current status indicates the domain remains active, though the page title displays 'Site not found,' which may suggest temporary takedown efforts or evasion tactics. Users and organizations are strongly advised to block access to this domain immediately. Network administrators should add the domain and its associated IP address (63.176.8.218) to firewall and DNS filtering rules. Individuals who may have interacted with this domain should monitor their accounts for unauthorized activity and consider revoking access to any linked credentials or cryptocurrency wallets. Vigilance is critical, as brand impersonation campaigns often employ multiple domains and infrastructure shifts to evade detection.