chiomnwakkeitexthnsn[.]webflow[.]io

The domain chiomnwakkeitexthnsn.webflow.io is currently offline but exhibits multiple indicators consistent with a high‑risk brand‑impersonation campaign targeting Coinbase users. The site was registered on May 08 2013 through MarkMonitor, Inc., and its DNS resolves to 172.64.151.8, an address owned by Cloudflare (AS13335) in the United States. Both the authoritative nameservers – journey.ns.cloudflare.com and lamar.ns.cloudflare.com – belong to Cloudflare, and the web server presents a Google Trust Services/WE1 SSL certificate, indicating that TLS termination is handled by the Cloudflare network. The HTTP response for the root URL returns a 404 status code, and the only observable page title is “Getting Started: Wallet Extension – Coinbase,” which aligns with the declared brand target.

VirusTotal has recorded 13 detections out of 95 scanning engines, and the domain appears on a single security blocklist, specifically PhishDestroy. Google Safe Browsing flags the domain for social engineering, reinforcing the suspicion of credential‑harvesting intent. Network‑level observations show the use of HTTP/3, a protocol commonly leveraged by legitimate Cloudflare‑hosted services but also adopted by malicious actors to improve performance and evade some legacy inspection tools. The combination of a legitimate‑looking page title referencing Coinbase, the use of a trusted SSL certificate, and the presence of multiple vendor detections demonstrates a clear attempt to masquerade as an official Coinbase wallet extension page.

However, the site is currently returning 404, and no additional content has been captured, leaving the exact phishing payload or credential‑capture mechanism unknown. Defenders should add the fully qualified domain name and its resolving IP address to web‑filter and DNS‑sinkhole policies, monitor for any future re‑activation of the host, and enforce multi‑factor authentication for Coinbase accounts.