coinbaseexchang[.]webflow[.]io

Analysis of coinbaseexchang.webflow.io indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc. and is served through Cloudflare’s network using HTTP/3. Both authoritative nameservers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, are Cloudflare‑controlled, confirming the hosting provider. The TLS certificate presented is issued by Google Trust Services under the WE1 root, which is typical for Cloudflare‑proxied sites and does not, by itself, indicate malicious intent. A HTTP request to the domain returns a 404 status with the page title "404 - Page not found," and the site is currently listed as offline.

Google Safe Browsing flags the domain for social engineering, and the domain appears on one external security blocklist and is blocked by PhishDestroy. VirusTotal records 15 of 95 scanning engines flagging the domain, reinforcing the suspicion of malicious activity. The registrar is MarkMonitor, Inc., and the domain was originally created on May 08, 2013. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme distrust.

The intelligence explicitly labels the operation as a crypto‑scam that impersonates Coinbase, but no further content analysis is available because the site returns only a generic 404 page. Uncertainty remains regarding any active payload, phishing pages, or credential‑harvesting forms, as no live content could be examined. Defenders should treat the domain as malicious: add the domain and its resolving IP to web‑filter deny lists, monitor DNS queries for related subdomains, and enforce outbound traffic controls that block connections to Cloudflare‑hosted IPs associated with this identifier. Continuous re‑evaluation is advised in case the infrastructure is re‑activated or new content is observed.