sso--secure--coinbasepro-cdn-i-autth[.]webflow[.]io

The domain sso--secure--coinbasepro-cdn-i-autth.webflow.io was registered on March 02, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 104.18.36.248, which belongs to AS13335 owned by Cloudflare, Inc., located in the United States. The site presents a SSL certificate issued by Google Trust Services under the WE1 authority, indicating the use of standard web‑hosting TLS provisioning rather than a custom or self‑signed certificate. The observed HTTP response code is 404 and the page title returned is "404 - Page not found," suggesting the malicious content has been removed or the site has been deliberately disabled.

Detection data indicates that 13 of 93 security vendors on VirusTotal flagged the domain, and Google Safe Browsing classifies it as a social engineering threat. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The listed scam type is a crypto scam, and the domain impersonates the Coinbase brand, which aligns with the known intent to lure victims into credential or wallet compromise. Technologies detected include Cloudflare services and HTTP/3 support, confirming the use of a modern CDN for delivery.

While the site is no longer serving content, the presence of the domain in multiple blocklists and the detection count demonstrate that it was previously considered malicious. Defenders should continue to enforce blocklist rules that include this domain, monitor for any re‑registration attempts on similar sub‑domains, and maintain vigilance for outbound connections to the 104.18.36.248 address, especially from endpoints that handle cryptocurrency assets. Additionally, security teams should update phishing awareness material to reference this specific impersonation of Coinbase, reinforcing that legitimate Coinbase communications never originate from a webflow.io sub‑domain.