coiinbasewalleetextension[.]webflow[.]io

This domain, coiinbasewalleetextension.webflow.io, is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site mimics the legitimate Coinbase Wallet Extension, presenting itself under the page title 'Coinbase Wallet Extension - Your key to the world of crypto.' The intent appears to be credential theft or cryptocurrency fraud, leveraging the trusted Coinbase brand to deceive users into disclosing sensitive information or transferring assets to attacker-controlled wallets. No direct evidence of a crypto drainer kit was observed, but the site's structure and branding align with known credential harvesting tactics used in cryptocurrency-related phishing campaigns. Technical indicators confirm the malicious nature of this domain. The domain was created on March 06, 2026, and is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335), which is frequently exploited to obscure the true origin of phishing sites. Google Safe Browsing explicitly flags this domain as phishing. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, while it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the risk, as encrypted connections are standard even for malicious sites. As of the latest assessment, coiinbasewalleetextension.webflow.io has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Users who interacted with this site are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. The remaining risk persists due to the domain's registration status and the potential for similar impersonation attempts using slight variations of the Coinbase brand.