69aef5d35723ce18449962c9--coinbase-clone-demo[.]netlify[.]app

The domain 69aef5d35723ce18449962c9--coinbase-clone-demo.netlify.app was registered on March 10, 2026 through Netlify and is currently listed as offline, returning an HTTP 404 status with the page title "Site not found." Infrastructure analysis shows the domain resolves to IP address 63.176.8.218, which is hosted in Germany under ASN 16509 owned by Amazon.com, Inc. The site employed Netlify’s platform and HSTS, and presented a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming the use of a legitimate SSL provider. Google Safe Browsing has flagged the domain for social engineering, and three independent security blocklists have added it to their watchlists. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have blocked the domain, indicating broader recognition of its malicious intent.

VirusTotal scans show that ten of ninety‑four security vendors flagged the domain as malicious, reinforcing the high‑risk assessment. The domain is explicitly identified as impersonating the Coinbase brand, aligning with the classified crypto scam threat type.

Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the associated IP range, and update URL filtering policies to include the domain and its Netlify sub‑hosting infrastructure. Given the confirmed brand impersonation and multi‑vendor detection, any residual traffic should be considered hostile, and incident response teams should treat related alerts as high priority.