coindeskweb3rectification[.]netlify[.]app

Analysis of coindeskweb3rectification.netlify.app indicates a high-risk phishing domain classified as an investment scam. The domain, hosted on Netlify infrastructure, was registered through Netlify on May 9, 2018, and currently resolves to IP 98.84.224.111, located in the US under AS14618 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc, specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, which does not inherently indicate malicious activity but is consistent with legitimate hosting environments often exploited for phishing. Google Safe Browsing explicitly flags this domain for social engineering, a classification supported by 15 of 93 security vendors on VirusTotal. The domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, further corroborating its malicious status.

The page title, 'Decentralization,' aligns with common themes in investment scams targeting cryptocurrency users, though the exact content and mechanics of the scam remain unconfirmed due to the domain's current offline status (HTTP 404). Infrastructure analysis reveals the use of Netlify's hosting and HSTS technology, which enforces HTTPS connections—a feature often leveraged by threat actors to appear legitimate. Nameservers are provided by NS1 (dns1.p01.nsone.net through dns4.p01.nsone.net), a reputable DNS provider, which does not mitigate the domain's malicious classification. The domain's creation date predates the report date by eight years, but this does not preclude its use in recent malicious campaigns, as older domains are frequently repurposed for phishing.

Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking is recommended, particularly for organizations in the cryptocurrency or financial sectors. Given its presence on multiple blocklists and detection by major vendors, further investigation into associated IP ranges (e.g., 98.84.224.