conebase-pro-wllit[.]webflow[.]io

The domain conebase-pro-wllit.webflow.io has been identified as a high-risk phishing resource specifically designed to impersonate Coinbase, a major digital asset exchange platform. This domain falls under the threat category of brand impersonation, targeting users of the legitimate Coinbase Pro Wallet service. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure remain under scrutiny for residual risk factors. Infrastructure analysis reveals that the domain was flagged by 11 out of 95 security vendors on VirusTotal, indicating widespread detection of malicious intent. It was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate corporate domains, which may have contributed to initial evasion of detection. The domain resolved to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used to mask the true origin of phishing infrastructure. Created on May 8, 2013, the domain’s age is atypical for phishing campaigns, suggesting either prolonged dormant use or repurposing of an older, previously benign domain. The domain appears on at least one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), was likely leveraged to lend false legitimacy to the phishing page. Google Safe Browsing has explicitly flagged this domain for phishing activity, corroborating the malicious classification. Current status confirms that conebase-pro-wllit.webflow.io has been rendered offline, mitigating immediate user exposure. However, the domain’s historical infrastructure and registration details warrant continued monitoring to prevent potential reactivation or reuse in future campaigns. Organizations and users are advised to block the domain and its associated IP address (172.64.151.8) at the network level to prevent accidental access. Security teams should review logs for prior connections to this domain and investigate any interactions with the phishing page, particularly those involving credential submission or financial transactions. Proactive measures include updating endpoint protection rules to detect similar impersonation attempts and educating users on identifying brand impersonation tactics, such as subtle Unicode character substitutions in domain names (e.g., the use of 'ǡ' in 'Coinbǡse'). Given the high-risk nature of this domain and its association with a trusted financial platform, immediate remediation and threat hunting are recommended to ensure no residual compromise exists within affected environments.