coinbsewalletextensione[.]webflow[.]io

Analysis of coinbsewalletextensione.webflow.io shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on March 6, 2026 through Webflow and resolves to IP 172.64.151.8, which belongs to the Cloudflare network (AS13335) in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS connection despite the malicious purpose. The HTTP response is a 404, suggesting the content was removed after the takedown, and the page title recorded during previous scans reads "Coinbase Wallet is now available as a standalone …," directly referencing the Coinbase brand.

VirusTotal scans have flagged the domain in 11 of 94 security engines, and the domain appears on three independent security blocklists. Additional blocklist entries from PhishDestroy, MetaMask, and SEAL corroborate the detection. The intelligence tags the activity as a crypto‑scam, specifically a brand‑impersonation attempt.

While the current offline status limits immediate victim exposure, the infrastructure—Cloudflare hosting, a legitimate SSL certificate, and a recent registration—demonstrates a typical fast‑flux style deployment that can be reactivated quickly. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or resurgence of the host, and include the associated IP and TLS fingerprint in threat‑intel feeds. Ongoing observation of related Webflow‑hosted domains is advised, as attackers frequently leverage the platform for rapid campaign turnover.