coinbase-mulcahy[.]netlify[.]app

This domain, coinbase-mulcahy.netlify.app, operates as a high-risk brand impersonation scheme specifically targeting Coinbase, a major cryptocurrency exchange platform. The site is designed to deceive users into believing they are interacting with legitimate Coinbase services, potentially leading to unauthorized access to sensitive account credentials, financial data, or direct cryptocurrency theft through fraudulent transaction prompts. The infrastructure is engineered to exploit trust in the Coinbase brand, often through cloned interfaces or deceptive login portals that harvest user inputs in real time. Analysis indicates concrete evidence of malicious intent, with six out of ninety-five security vendors on VirusTotal flagging the domain as malicious. The domain was registered on March 12, 2026, through Netlify, a platform commonly abused for hosting phishing content due to its ease of deployment and low cost. It appears on three independent security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy and MetaMask. The SSL certificate, issued by DigiCert Inc, is legitimate but does not mitigate the domain's fraudulent purpose, as threat actors frequently use valid certificates to lend false credibility to malicious sites. The domain resolves to IP address 35.157.26.135, hosted on Amazon.com, Inc. infrastructure in Germany (AS16509), a common pattern observed in phishing campaigns leveraging cloud services for scalability and anonymity. Users who have visited coinbase-mulcahy.netlify.app should immediately cease all interaction with the domain and assume any credentials or financial details entered have been compromised. It is critical to change passwords for Coinbase and any other accounts where identical credentials may have been reused, enabling multi-factor authentication where available. Monitor financial statements and cryptocurrency wallets for unauthorized transactions, and report any suspicious activity to the targeted brand’s official fraud response team. If cryptocurrency was transferred under false pretenses, contact the wallet provider or exchange immediately to attempt transaction reversal or freezing. Security teams should blacklist the domain and IP address across all network defenses to prevent further exposure.