sso-cdn----coinbasepro--visit-auth[.]webflow[.]io

This domain, sso-cdn----coinbasepro--visit-auth.webflow.io, poses a specific threat of brand impersonation, targeting the well-known cryptocurrency exchange Coinbase. The domain is designed to mimic legitimate Coinbase URLs, potentially misleading users into divulging sensitive information such as login credentials or personal data.

Analysis indicates that the domain has been flagged by 13 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion and potential risk. The domain is registered through MarkMonitor, Inc., and was created on May 08, 2013. Infrastructure analysis reveals that it resolves to an IP address (104.18.36.248) located in the United States and is associated with Cloudflare, Inc. (AS13335). Additionally, the domain appears on 2 security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious nature.

If users have visited this domain, they are advised to immediately change their Coinbase account passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their accounts for any unauthorized transactions and report any suspicious activity to Coinbase support. It is recommended to avoid clicking on links or entering personal information on unfamiliar or suspicious websites in the future.