helpcenterinfo-coinbase[.]netlify[.]app

The domain helpcenterinfo-coinbase.netlify.app was observed on July 23, 2026 targeting the Coinbase brand. The site presented the page title “Help Center” and was classified as a crypto‑scam impersonating Coinbase. TLS inspection shows a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc, indicating a valid certificate chain but offering no assurance of legitimacy. DNS resolution returned the IPv6 address 2600:1f18:16e:df01::259, which belongs to Amazon.com, Inc. (AS14618) and is hosted in the United States.

The domain is hosted on Netlify infrastructure, as reflected by the Netlify technology fingerprint and the presence of HTTP Strict Transport Security (HSTS). An HTTP request returned a 404 status, and the nameserver query returned NS_NOT_FOUND, limiting further enumeration of authoritative name servers. Threat intelligence sources flag the domain: VirusTotal recorded 14 detections out of 95 scanning engines, Google Safe Browsing labeled it as social‑engineering, and a single external blocklist includes the host. PhishDestroy has actively blocked the domain.

The registrar information confirms deployment through Netlify’s automated provisioning service. Current evidence stops short of revealing the actual content served, and the 404 response prevents verification of the phishing page. Defenders should add the IPv6 address and the full domain to URL filtering and endpoint protection rules, monitor Netlify‑hosted assets for similar patterns, and maintain the blocklist entries. Ongoing surveillance of Netlify‑related activity is advised to detect re‑use of the naming convention or similar impersonation attempts.