public-coinbase-pro-cdn[.]wstd[.]io

The domain public-coinbase-pro-cdn.wstd.io was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 104.19.164.34, which belongs to Cloudflare, Inc. (ASN AS13335) and is geolocated in the United States. The site hosted an SSL certificate issued by Let\u2019s Encrypt, identified as version E8, and responded with an HTTP 401 status code, indicating that authentication was required.

Google Safe Browsing has flagged the domain for social engineering, and 16 of 95 VirusTotal security vendors have marked the host as malicious, reinforcing the suspicion of abusive activity. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting an extremely low confidence in its legitimacy.

The intelligence indicates that the domain was used to impersonate Coinbase, aligning with the declared brand target and the Crypto Scam classification. While the site is no longer reachable, the combination of registrar age, hosting on a high‑reputation CDN, low trust score, multiple vendor detections, and safe‑browsing classification provides sufficient evidence to treat the domain as a confirmed malicious infrastructure. Defenders should continue to block the associated IP range, monitor for similarly constructed subdomains, and ensure that endpoint protection solutions are updated to reflect the observed indicators of compromise.