clinquant-naiad-0a239f[.]netlify[.]app

The domain clinquant-naiad-0a239f.netlify.app is currently offline but exhibits multiple indicators consistent with a brand impersonation campaign targeting Banco de Venezuela. Registration data shows the site was created on May 09, 2018 and is hosted on Netlify, a platform commonly used for rapid deployment of malicious pages. DNS resolution points to the address 98.84.224.111, which belongs to Amazon.com, Inc. (AS14618) in the United States, confirming that the underlying infrastructure is provided by a major cloud provider. The site presented a valid SSL certificate issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, indicating the attackers obtained a trusted certificate to lend legitimacy to the domain. Nameservers are supplied by NS1 (dns1.p01.nsone.net through dns4.p01.nsone.net), a typical configuration for Netlify-hosted sites.

An HTTP request returned a 404 status, suggesting the content has been removed or the site is no longer serving pages. The page title observed before takedown was "Banco de Venezuela," directly aligning with the declared brand target. Scamadviser assigned a trust score of 1/100, reflecting extreme risk. VirusTotal analysis recorded 19 detections out of 93 security vendors, demonstrating that a notable subset of scanners flagged the domain as malicious.

The domain appears on a single public blocklist and is actively blocked by PhishDestroy, confirming that at least one community‑maintained feed recognized it as a threat. The combined evidence—cloud hosting, a trusted SSL certificate, low trust score, multiple vendor detections, and explicit brand impersonation—warrants classification as an elevated‑risk impersonation site. Defenders should ensure the domain is blocked at DNS and proxy layers, monitor for any re‑registration on similar Netlify sub‑domains, and consider adding the associated IP range (AS14618) to broader threat‑intel watchlists.