public-coinbasepro-cdn-authd[.]webflow[.]io

This domain, public-coinbasepro-cdn-authd.webflow.io, poses a targeted brand impersonation threat against Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site was designed to mimic Coinbase’s official authentication or CDN-related endpoints, likely to deceive users into entering credentials or downloading malicious payloads under the guise of legitimate Coinbase infrastructure. The inclusion of terms like 'coinbasepro' and 'cdn-authd' in the subdomain structure suggests an attempt to exploit trust in Coinbase’s Pro trading platform and content delivery networks, increasing the likelihood of successful social engineering attacks against users familiar with these services. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered through MarkMonitor, Inc. on May 08, 2013, though its recent misuse aligns with a pattern of repurposed or compromised legacy domains. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers and evade detection. Security vendors on VirusTotal flagged the domain at a rate of 13 out of 95, indicating moderate to high confidence in its malicious classification. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its fraudulent nature. The SSL certificate issued by Google Trust Services (WE1) does not mitigate the risk, as legitimate certificates are frequently abused in phishing campaigns to lend an air of authenticity. Users who visited this domain should take immediate action to mitigate potential risks. First, revoke any sessions or credentials that may have been entered on the site, particularly those associated with Coinbase or other cryptocurrency services. Monitor financial accounts and transaction histories for unauthorized activity, as stolen credentials could be used to initiate fraudulent transfers. If any software or files were downloaded from the domain, perform a full system scan using updated security tools to detect and remove potential malware. Finally, report the domain to relevant security teams or platforms to aid in broader threat mitigation efforts. Given the elevated risk level, affected users should also consider enabling multi-factor authentication on all critical accounts to prevent unauthorized access.