coinbase-clone-imma[.]netlify[.]app

This domain, coinbase-clone-imma.netlify.app, operates as a high-risk phishing site designed to impersonate the Coinbase cryptocurrency platform. The site presents itself as a legitimate Coinbase interface, using cloned branding, login forms, and transaction prompts to deceive visitors into entering sensitive credentials, wallet recovery phrases, or private keys. Such impersonation schemes typically aim to steal cryptocurrency assets by redirecting victims to attacker-controlled wallets or harvesting login details for unauthorized account access. The threat extends beyond individual users, as compromised credentials may enable further attacks against associated services or contacts. Analysis indicates this domain was created on March 10, 2026, and is hosted on infrastructure provided by Netlify, resolving to the IP address 63.176.8.218, located in Germany under Amazon.com, Inc. (AS16509). The domain appears on three security blocklists and is flagged by Google Safe Browsing as phishing. VirusTotal reports confirm that 15 out of 95 security vendors detect the domain as malicious, with additional blocking by multiple threat intelligence platforms. The SSL certificate, issued by DigiCert Inc, uses the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, a common certificate authority that does not inherently validate the legitimacy of the site’s content. The page title, 'coinbase-clone,' further suggests an intentional effort to mimic the Coinbase brand while maintaining plausible deniability. If a user has visited coinbase-clone-imma.netlify.app or interacted with its content, immediate action is required to mitigate potential compromise. First, cease all interaction with the site and avoid entering any credentials or personal information. If login details or wallet recovery phrases were submitted, assume they are compromised and revoke access to any associated accounts or wallets. Reset passwords using a secure device and enable multi-factor authentication where available. Monitor linked accounts for unauthorized transactions or changes, and consider transferring cryptocurrency assets to a new wallet if private keys were exposed. Report the incident to the impersonated platform’s security team and relevant financial authorities to assist in tracking the threat. Users should also scan their devices for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.