coinbase-exchange-details[.]netlify[.]app

Analysis conducted on July 24, 2026 identifies coinbase-exchange-details.netlify.app as a high‑risk brand‑impersonation site targeting Coinbase users. The domain was registered on March 3, 2026 and is hosted on Netlify, as indicated by the detected Netlify technology stack and the presence of HTTP Strict Transport Security (HSTS). DNS resolution points to IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The site presents a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming proper TLS deployment but offering no mitigation against malicious use. An HTTP request returns a 404 status, and the site is currently taken offline, limiting direct content analysis.

However, the page title “Coinbase Exchange Operations, Features, and Security Guide” suggests an attempt to mimic official Coinbase documentation to lure victims. Security aggregators have flagged the domain: Google Safe Browsing classifies it as social engineering, three independent blocklists list it, and PhishDestroy, MetaMask, and SEAL have applied blocks. VirusTotal analysis shows nine of ninety‑three scanners label the domain as malicious, reinforcing the risk assessment. The risk level is marked as high, reflecting the potential monetary loss if victims are deceived into providing cryptocurrency credentials.

While the exact landing page content cannot be verified due to the 404 response, the convergence of brand‑targeted naming, impersonating page title, and multiple independent detections indicates a deliberate crypto‑related scam. No additional infrastructure such as external C2 servers or script kits was observed in the current data set. Defenders should continue to block the domain at the network perimeter, update threat‑intelligence feeds with the observed indicators, and monitor for any re‑hosting attempts that may reuse the same Netlify or Amazon infrastructure.