coinaqareloginnn[.]webflow[.]io

This domain, coinaqareloginnn.webflow.io, is identified as a credential phishing operation targeting cryptocurrency users. Analysis indicates the infrastructure was designed to mimic legitimate Coinbase login portals, likely to harvest credentials for subsequent account takeovers or crypto wallet drainage. No specific drainer kit signatures were detected in available telemetry, though the domain structure and naming convention strongly suggest intent to impersonate Coinbase authentication workflows. Technical indicators confirm elevated risk: the domain is flagged by 16 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was registered through Webflow on April 04, 2026. It resolves to IP address 172.64.151.8, utilizes Cloudflare infrastructure with HTTP/3 support, and presents a Google Trust Services SSL certificate. The current page title reads '404 - Page not found,' which may indicate either takedown or temporary concealment of malicious content. No Google Safe Browsing detections were recorded at the time of analysis. The domain is currently offline, having been blocked by at least one security provider. While the immediate threat appears mitigated, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations should monitor for credential reuse attempts, particularly against Coinbase or other crypto exchange accounts. Users are advised to reset passwords for any accounts accessed during the domain's active period and enable multi-factor authentication on all financial and crypto-related services. Network-level blocking of the domain and associated IP is recommended as a preventive measure.