riffbase[.]netlify[.]app

The domain riffbase.netlify.app was observed hosting a crypto‑related phishing campaign and is currently taken offline. DNS resolution points to the IP address 18.208.88.157, which belongs to Amazon.com, Inc. (AS14618) and is located in the United States. The site was served through Netlify, as indicated by the detected Netlify technology stack and the presence of a DigiCert‑issued TLS certificate (DigiCert Global G2 TLS RSA SHA256 2020 CA1). The certificate chain is valid, and HSTS is enforced, suggesting an attempt to convey legitimacy. An HTTP request to the domain returns a 404 status code and the page title “Site not found”, confirming that the content has been removed or disabled.

Despite the offline status, the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, reinforcing the malicious classification. The only explicit threat indicator supplied is the designation “Crypto Scam”. No additional brand or service is referenced in the available metadata, and the page content itself has not been captured, leaving the exact phishing lure undefined.

The lack of a recorded nameserver (NS_NOT_FOUND) and the generic page title further limit attribution. For defenders, the observable indicators—IP address 18.208.88.157, Netlify hosting, DigiCert TLS certificate, HSTS header, 404 response, blocklist entry, and VirusTotal detections—should be added to threat‑intel feeds and endpoint detection rules. Network traffic to the IP should be monitored for any residual connections, and DNS filtering policies should block the domain to prevent future re‑activation. Because the site is offline, active mitigation is limited to pre‑emptive blocking and awareness of the associated infrastructure.