coinbasenvprologin[.]webflow[.]io

This domain is flagged as a high-risk brand impersonation phishing site targeting Coinbase, a major digital asset exchange platform. Analysis indicates the site was designed to deceive users into entering credentials by mimicking the official Coinbase Pro login interface, as evidenced by the page title 'Çoinbase* Pro : Login | Digital Asset Exchange(Official Website).' The threat type is specifically classified as brand impersonation, a tactic commonly used to harvest sensitive financial and personal data from unsuspecting victims. Infrastructure analysis reveals multiple indicators of malicious activity. The domain coinbasenvprologin.webflow.io is detected by 19 out of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The domain was registered through MarkMonitor, Inc. on May 08, 2013, and currently resolves to the IP address 104.18.36.248, which is associated with AS13335 Cloudflare, Inc. in the United States. Google Safe Browsing has flagged the domain as phishing, and it is currently offline. The SSL certificate is issued by Google Trust Services under the identifier WE1, which does not mitigate the risk given the domain's fraudulent purpose. Mitigation steps for this type of threat include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update their email and web filtering rules to prevent users from accessing or interacting with the domain. Security teams are advised to monitor for any attempts to reuse the domain or similar infrastructure, particularly those leveraging Cloudflare hosting or MarkMonitor registrations. Users who may have interacted with the site should be instructed to reset their credentials on the legitimate platform and enable multi-factor authentication to prevent unauthorized access. Additionally, security awareness training should emphasize the risks of brand impersonation and the importance of verifying domain authenticity before entering sensitive information.