help--extenssion--coinbase[.]webflow[.]io

The domain help--extenssion--coinbase.webflow.io is currently offline, returning an HTTP 404 status, but its infrastructure indicates a deliberate attempt to impersonate Coinbase. The page title captured from historical scans reads "Coinbase® Extension® | Getting Started: Wallet Extension," directly referencing the brand and suggesting a fake wallet extension. Registration data shows the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by high‑value brands, which may lend false credibility to the site.

Hosting is provided by Cloudflare, as evidenced by the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the service resolves to IP address 172.64.151.8 belonging to AS13335 Cloudflare, Inc. in the United States. The site employed Cloudflare’s HTTP/3 protocol and presented an SSL certificate issued by Google Trust Services under the WE1 label, indicating that TLS encryption was in place despite the malicious intent. Threat intelligence shows that 12 of 93 security vendors on VirusTotal flagged the domain, and it appears on at least one public blocklist, with PhishDestroy explicitly listing it as blocked.

These indicators collectively support an elevated risk rating for brand impersonation. Defenders should add the domain and its associated IP address to blocklists, monitor DNS queries for the listed Cloudflare nameservers, and ensure that any user‑facing security controls (e.g., URL filtering, email gateway safeguards) explicitly deny access to this host. Since the site is offline, continuous re‑validation is advised to detect any re‑activation, and any inbound traffic logs should be reviewed for prior access attempts that may indicate compromised credentials or attempted credential harvesting against Coinbase users.