coinbaseawallet[.]my[.]canva[.]site

Analysis of the domain coinbaseawallet.my.canva.site indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The site was created on 03 April 2018 and is currently taken offline, returning HTTP 404. It resolves to IP 103.169.142.250, which is located in Australia and belongs to AS209242 Cloudflare London, LLC. The hosting infrastructure is protected by Cloudflare and serves content over HTTP/3. The TLS certificate is issued by Google Trust Services under the “WE1” designation, confirming the use of a legitimate certificate authority but not mitigating the impersonation risk.

The page title observed in prior captures reads “Coinbase Wallet: NFTs & Crypto”, and the domain explicitly impersonates the Coinbase brand, fitting the reported crypto‑scam classification. Security‑vendor scanning on VirusTotal recorded 10 detections out of 95 scanners, and Google Safe Browsing has flagged the URL for social‑engineering content. The domain appears on a single public blocklist and is listed as blocked by the PhishDestroy service. Registration information shows the domain was registered through Gandi SAS, with authoritative name servers jean.ns.cloudflare.com and junade.ns.cloudflare.com.

Defenders should immediately add coinbaseawallet.my.canva.site to deny‑list rules on perimeter and endpoint controls, as the domain has already been identified by multiple detection sources. Monitoring of the associated IP address and the Cloudflare name‑server pair is advised, since the attacker may reuse the same hosting assets for future campaigns. Given the legitimate SSL certificate, reliance on certificate validation alone is insufficient; correlation with brand‑specific indicators such as the page title and impersonation of Coinbase should be incorporated into detection logic. Continuous review of VirusTotal and Google Safe Browsing updates for this host is recommended, as the offline status may change if the adversary reactivates the site.