login-web3-coinbase[.]wstd[.]io

The domain login-web3-coinbase.wstd.io is confirmed as a brand impersonation phishing resource targeting Coinbase, a major cryptocurrency exchange platform. This domain was operational under the guise of legitimate Web3 or Coinbase login services but is currently offline. Analysis indicates the infrastructure was designed to harvest user credentials, likely through a fraudulent login portal mimicking Coinbase’s authentication interface.

Technical indicators reveal the domain was flagged by 22 of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing and one security blocklist. It was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 172.67.68.74, hosted on Cloudflare’s network (AS13335). The SSL certificate was issued by Let’s Encrypt (serial number E8), a common tactic to lend superficial legitimacy to phishing sites. The creation date suggests an attempt to exploit future trends in cryptocurrency adoption, though the domain was taken offline before widespread abuse could occur.

Current status confirms the domain is offline, reducing immediate risk to end users. However, infrastructure analysis reveals the use of Cloudflare hosting, a pattern observed in other phishing campaigns due to its anonymity and resilience. Organizations and individuals are advised to block the domain and IP at the network level, monitor for credential theft attempts, and educate users on identifying brand impersonation tactics. Security teams should review logs for connections to 172.67.68.74 and investigate any associated credential submissions. Given the high-risk nature of cryptocurrency phishing, proactive monitoring of newly registered domains with similar naming patterns is recommended.