koinbaseprologin[.]webflow[.]io

The domain koinbaseprologin.webflow.io is flagged by Google Safe Browsing for social engineering and has been listed by PhishDestroy as a known crypto‑related impersonation of Coinbase. Registration details show the domain was created on May 08, 2013 and is held through MarkMonitor, Inc., a registrar commonly used for legitimate brand assets, which suggests the domain may have been compromised or repurposed for malicious use. The site resolves to IP address 172.64.151.8, an address owned by Cloudflare, Inc. (ASN 13335) and located in the United States. DNS resolution uses Cloudflare authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the infrastructure advertises HTTP/3 support.

TLS termination is provided by a Google Trust Services certificate (WE1), indicating a valid SSL chain despite the malicious intent. An HTTP 404 response is returned, and the current status is offline, limiting immediate content analysis. However, the page title "Coinbase Exchange | Institutional Trading Platform" clearly references Coinbase, confirming brand impersonation. VirusTotal has recorded 13 detections out of 95 scanned security vendors, reinforcing the malicious classification.

The domain appears on a single security blocklist, but its presence in multiple detection ecosystems warrants heightened vigilance. Uncertainty remains around the exact content that was served before takedown, as no live page is available for forensic capture. Defenders should add koinbaseprologin.webflow.io to inbound and outbound filtering rules, monitor the associated IP 172.64.151.8 for any resurgence, and report the abuse to Cloudflare to facilitate remediation. Continuous tracking of detection updates and coordination with Coinbase’s brand protection team are recommended to mitigate potential credential‑stealing campaigns that may leverage similar Webflow‑hosted impersonation sites.