coinbase-canada-login[.]webflow[.]io

The domain coinbase-canada-login.webflow.io is presently offline but was previously identified as a high‑risk brand‑impersonation site targeting Coinbase users. Registration records show the domain was created on 08 May 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by legitimate trademark owners, which may be intended to lend credibility. DNS resolution points to Cloudflare’s infrastructure; the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the A record resolves to 104.18.36.248, an IP address owned by AS13335 Cloudflare, Inc., in the United States. The site served a TLS certificate issued by Google Trust Services under the WE1 authority, indicating standard HTTPS support despite the malicious intent. A page title retrieved from the site, “Coinbase® Login® | Sign In To My Account,” directly mimics the official Coinbase login phrasing, confirming a brand‑impersonation vector.

HTTP probing returned a 404 status, suggesting that the original content may have been removed or the site is deliberately serving error responses after takedown. Automated scanning on VirusTotal recorded 14 detections out of 95 security vendors, reinforcing the malicious classification. Google Safe Browsing flagged the domain for social engineering, and PhishDestroy has listed it as blocked, with the domain appearing on one additional security blocklist. The underlying technology stack includes Cloudflare services and HTTP/3, consistent with the hosting provider’s default configuration. The evidence points to a crypto‑scam campaign that leverages the Coinbase brand to lure victims into credential harvesting or fund diversion.

Uncertainty remains regarding the exact payload or phishing page content, as the site is no longer reachable for direct analysis.