coinbasewallet-restore-su-guildes[.]webflow[.]io

This domain, coinbasewallet-restore-su-guildes.webflow.io, is identified as a high-risk brand impersonation campaign targeting users of the cryptocurrency exchange Coinbase. The threat involves the creation of a fraudulent interface designed to deceive victims into disclosing sensitive credentials or authorizing malicious transactions, aligning with observed patterns of cryptocurrency wallet compromise. The domain’s infrastructure and behavioral indicators strongly suggest an intent to exploit trust in the targeted brand for financial gain. Analysis of the domain reveals multiple technical indicators corroborating its malicious nature. The domain was registered through Webflow, a platform frequently leveraged for rapid deployment of deceptive pages. It resolves to the IP address 104.18.36.248, which is associated with Cloudflare’s content delivery network, a common tactic to obfuscate hosting origins and evade detection. Google Safe Browsing has flagged the domain under the category SOCIAL_ENGINEERING, further validating its deceptive intent. Security vendors on VirusTotal have flagged the domain at a detection rate of 6/95, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may lend an appearance of authenticity to unsuspecting users. The page title, 404 - Page not found, suggests the domain may have been taken offline or altered post-detection, though residual risk remains due to its prior activity. Mitigation of this brand impersonation threat requires a multi-layered approach. Organizations should ensure that domain monitoring systems are configured to detect and block subdomains or domains containing variations of the targeted brand name, particularly those registered through platforms enabling rapid deployment. Network-level protections should be updated to include the identified IP address (104.18.36.248) and associated indicators in blocklists. End-users should be educated on verifying domain authenticity, particularly for cryptocurrency-related interactions, and instructed to scrutinize URLs for subtle misspellings or unusual subdomains. In cases where credentials or wallet access may have been compromised, immediate revocation of permissions and multi-factor authentication enforcement is recommended to prevent unauthorized transactions.