hackathon-dapp-template[.]thedanielmark[.]app

Analysis of hackathon-dapp-template.thedanielmark.app shows a newly registered site that is actively serving content (HTTP 200) and presents the generic page title “Create Next App”. The domain is protected by a Let’s Encrypt R13 certificate and was registered through Namecheap Inc. DNS resolution points to IP 66.33.60.66, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment reports Vercel services and HTTP Strict Transport Security headers, while the authoritative name servers are camilo.ns.cloudflare.com and josephine.ns.cloudflare.com, indicating Cloudflare DNS front‑end. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Coinbase, employing an “Airdrop Scam” phishing kit that falls under cryptocurrency fraud. The site is already listed on PhishDestroy and appears on one additional security blocklist; its Gridinsoft trust score is 0 / 100, confirming a high‑confidence malicious classification. Current status is active and the investigation level is under_investigation. Concrete evidence of the malicious intent is limited to the known kit type and the impersonation label; the actual page content has not been disclosed beyond the title, so the exact lure and credential‑capture mechanisms remain uncertain. Defenders should immediately block network connections to 66.33.60.66 and add the domain to URL filtering policies that target Coinbase‑related phishing. Continuous monitoring of DNS queries for the two Cloudflare name servers is advised, as well as periodic re‑scanning with updated threat feeds to capture any changes in hosting or payload. Because the site uses legitimate SSL and a reputable CDN, traditional certificate‑based allow‑lists may not be sufficient; contextual analysis of outbound requests to the domain should trigger alerts. In summary, the infrastructure, trust‑score, and known kit strongly indicate a fraudulent operation, and proactive containment is recommended.