cbb[.]d3dgx0j13hf13f[.]amplifyapp[.]com

Analysis of the sub‑domain cbb.d3dgx0j13hf13f.amplifyapp.com shows a high‑confidence brand‑impersonation campaign targeting Coinbase users. The domain resolves to the IPv4 address 18.173.205.63, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to Germany. Hosting on Amazon’s infrastructure is consistent with many legitimate Amplify applications, yet the specific sub‑domain is not associated with any known Coinbase service. The site presented the page title “Download Coinbase Wallet - Official Website,” a clear indicator of a Coinbase impersonation attempt, and the scam type is catalogued as a Crypto Scam.

No TLS certificate was observed, leaving the site vulnerable to man‑in‑the‑middle interception and indicating a lack of legitimate security controls. Reputation checks reveal a Gridinsoft trust score of 0 / 100 and a Google Safe Browsing flag for social engineering, confirming the malicious intent. VirusTotal recorded 13 of 93 antivirus engines flagging the domain, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and the registrar information lists NOM‑IQ Ltd dba Com Laude as the registrant; the domain was created on 17 April 2018 and uses four AWS‑managed name servers (ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, ns-904.awsdns).

The current operational status is offline, but the infrastructure footprint remains observable. Defenders should add the domain and its resolving IP to DNS‑based deny lists, monitor for any re‑activation, and enforce strict URL filtering for any references to Coinbase wallet downloads. Further investigation of related sub‑domains under the same AWS account may uncover additional malicious assets.