coinbase-chat[.]netlify[.]app

The domain coinbase-chat.netlify.app was registered on February 22, 2026 and is presently taken offline. DNS resolution points the domain to IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The site presents a valid DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, indicating that TLS termination is performed by the hosting provider rather than a self‑signed or expired certificate. Infrastructure fingerprints show deployment on Netlify and the presence of HTTP Strict Transport Security (HSTS), both consistent with the registrar information that lists Name.com, Inc. as the reseller for Netlify services.

An HTTP request to the host returns a 404 status code and the page title "Site not found," confirming that no active landing page is currently served. The domain is flagged by three independent blocklists—PhishDestroy, MetaMask, and SEAL—each of which categorises the site as a brand‑impersonation attempt targeting Coinbase. VirusTotal analysis shows that three of ninety‑five scanned security vendors have raised detections, reinforcing the suspicion of malicious intent despite the low overall count. The domain appears on three security blocklists and is classified as a crypto‑related scam, aligning with the observed brand impersonation of Coinbase.

Given the observable evidence, defenders should treat coinbase-chat.netlify.app as a high‑confidence malicious indicator. Recommended actions include adding the domain and its resolved IP address to deny lists, monitoring outbound traffic for attempts to reach the IP, and ensuring that any internal URL filtering or safe‑browsing services are updated to block the domain. Because the TLS certificate is legitimate, reliance on certificate validation alone is insufficient; correlation with blocklist entries and the 404 page title provides the necessary context for detection.