ciuoinbasewalletexteensiion[.]webflow[.]io

The domain ciuoinbasewalletexteensiion.webflow.io is currently active and has been identified as a crypto‑drainer infrastructure. Registration records show the domain was created through Webflow, Inc., a legitimate website‑building platform, which is often abused to host malicious pages. The domain resolves to the IP address 104.18.36.248, which belongs to the Cloudflare network, a common hosting choice for fast‑flux and proxy‑based phishing operations. DNS queries return no authoritative nameserver information (NS_NOT_FOUND), indicating that the domain relies on Cloudflare’s proxy DNS rather than exposing its own name servers. Threat intelligence feeds have placed the domain on a single security blocklist and PhishDestroy has actively blocked it.

Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal analysis shows that five of ninety‑one scanned security vendors flagged the domain, confirming a moderate level of detection across independent scanners. No further detail on the specific signatures or payloads is available from the VirusTotal report. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or trust‑score metrics, leaving the exact content of the landing page unverified. Consequently, the precise mechanisms used to lure victims—whether through fake wallet prompts, credential harvesting, or direct cryptocurrency address substitution—remain uncertain, though the threat type is explicitly listed as a crypto drainer.

Defenders should treat the domain as high‑risk. Immediate actions include adding the domain to DNS blocklists, configuring web‑proxy filters to deny any HTTP/HTTPS traffic to the address, and updating intrusion‑prevention signatures to reflect the five VirusTotal detections. Monitoring for any new sub‑domains under the same Cloudflare IP range is advisable, as the operator may generate additional variants.