coinbase-clone-assignment[.]netlify[.]app

Analysis of coinbase-clone-assignment.netlify.app shows a newly registered Netlify‑hosted site created on 10 March 2026 that is currently returning HTTP 404 with the page title “Site not found”. The TLS certificate presented is DigiCert Global G2 TLS RSA SHA256 2020 CA1, issued by DigiCert Inc, confirming the use of a legitimate certificate chain. DNS resolution points to 98.84.224.111, an address located in Germany and announced by AS16509, the Amazon.com, Inc. network. The hosting environment is identified as Netlify and the response header includes HTTP Strict Transport Security (HSTS), indicating the site enforces secure connections. The domain appears on three independent security blocklists—PhishDestroy, MetaMask, and SEAL—and has been flagged by nine of ninety‑four antivirus and URL‑reputation engines on VirusTotal.

These detections align with the declared scam type of “Crypto Scam” and the stated brand target of Coinbase, confirming that the domain is being used for brand impersonation. Registration information lists Netlify as the registrar, consistent with the hosting provider. Because the site is presently offline, direct content analysis is not possible; the only observable artifact is the generic “Site not found” title. No further indicators such as login forms, malicious scripts, or credential‑harvesting pages have been captured. The lack of active content limits the ability to attribute a specific phishing kit or payload, but the presence on multiple blocklists and the VirusTotal detections provide sufficient evidence for defensive action.

Defenders should immediately block the domain and its resolved IP address at perimeter and DNS filtering layers. Security teams should add the domain to internal URL reputation lists and monitor Netlify‑hosted subdomains for similar naming patterns. Continuous re‑scanning of the IP address is advised, as the host may be reused for other malicious deployments.