coinbayewallet[.]webflow[.]io

The domain coinbayewallet.webflow.io was observed hosting a page titled "Coinbase Wallet - Cryptocurrency Exchange for Bitcoin, Ethereum & Altcoins," directly referencing Coinbase’s brand. Technical analysis shows the domain resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc., and is served through Cloudflare’s HTTP/3 stack. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint at the time of capture. The site returned an HTTP 404 status, indicating the specific resource was not found when queried, yet the presence of the brand‑specific page title suggests prior content designed to impersonate Coinbase’s wallet service.

Google Safe Browsing flags the domain for social engineering, and VirusTotal recorded 16 detections out of 95 scanned security vendors, confirming that multiple anti‑malware engines consider the site malicious. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy feed. Registration data shows the domain was created on May 08, 2013 and was acquired through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may indicate a compromised or repurposed registration. The nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com reinforce the Cloudflare hosting relationship.

Scamadviser assigns a trust score of 1 / 100, reflecting extreme risk. The current status is offline, but historical activity demonstrates a crypto‑scam pattern targeting Coinbase users. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting attempts on the same IP range, and update detection rules to flag URLs containing the exact page title or similar brand‑impersonation cues.