auth-sso-coinbasepro--sso[.]webflow[.]io

The domain auth-sso-coinbasepro--sso.webflow.io was created on May 08, 2013 and is currently listed as offline. Technical analysis shows it resolves to 104.18.36.248, an address owned by Cloudflare (ASN13335) located in the United States. The domain uses Cloudflare’s DNS service, with authoritative name servers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and serves content over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS handshake despite the malicious intent.

The HTTP response returns a 404 status code, and the page title captured from the site reads "Official Website® of |Coinbase Pro: | Digital Asset Exchange®," directly mimicking the Coinbase brand. Google Safe Browsing classifies the site as a social engineering threat, and 15 of 95 VirusTotal scanners flag it as malicious, confirming a consensus among security vendors. PhishDestroy has added the domain to its blocklist, and it appears on one additional security blocklist. Scamadviser assigns a trust score of 1/100, reflecting extreme risk.

The registrar listed is MarkMonitor, Inc., a common registrar for brand‑protected domains, suggesting the registration may have been compromised or leveraged for abuse. The observed indicators collectively point to a high‑risk brand‑impersonation campaign targeting Coinbase users with a crypto‑scam payload. Uncertainty remains regarding the exact payload or phishing page content, as the site returns a 404 and no further content has been captured. Defenders should block the domain at network perimeters, update URL filtering and endpoint protection feeds with the observed indicators, and monitor for any future re‑activation of the domain or related sub‑domains.