coinbase-clone-p[.]netlify[.]app

The domain coinbase-clone-p.netlify.app is a phishing site engaged in brand impersonation targeting Coinbase, a cryptocurrency exchange. It posed an elevated risk as a cryptocurrency scam designed to deceive users into disclosing login credentials or sensitive information through fraudulent branding. The site is currently taken offline, and no drainer kit was detected in this instance.

Technical analysis shows that coinbase-clone-p.netlify.app was flagged by 2 of 95 VirusTotal security vendors, including ADMINUSLabs and Google Safe Browsing, which specifically marked it for 'SOCIAL_ENGINEERING'. The domain was registered through Netlify on March 10, 2026, and resolved to the IP address 35.157.26.135, hosted on Amazon.com, Inc. infrastructure in Germany. It appeared on three security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain. At the time of assessment, the site returned a 404 error with the page title 'Site not found' and employed technologies such as Netlify and HSTS.

Users who may have interacted with coinbase-clone-p.netlify.app should immediately change their Coinbase passwords and enable two-factor authentication to secure their accounts. Monitor transaction history for unauthorized activity and report any suspected fraud to Coinbase support. Additionally, victims can report the phishing domain to Google Safe Browsing, Netlify abuse channels, and relevant security blocklists to aid in takedown efforts.