sso--en-coinbasepro---cdn----auths[.]webflow[.]io

This domain, sso--en-coinbasepro---cdn----auths.webflow.io, is flagged for brand impersonation targeting Coinbase Pro, a digital asset exchange platform. The site mimics the official Coinbase Pro interface, presenting itself as "Official Site® | Coinbase Pro | Digital Asset Exchange®" to deceive users into submitting credentials or financial information. Such impersonation attacks are designed to exploit trust in established brands, often leading to unauthorized account access or financial theft. The domain’s infrastructure and page title closely resemble legitimate Coinbase Pro properties, increasing the likelihood of successful deception among unsuspecting users.

Analysis indicates the domain was registered on May 08, 2013, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), which provides anonymity and resilience against takedowns. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, a detection rate consistent with active phishing campaigns. The SSL certificate, issued by Google Trust Services (WE1), further lends a false sense of legitimacy to the site, as users may interpret the presence of HTTPS as an indicator of authenticity.

Users who visited sso--en-coinbasepro---cdn----auths.webflow.io should assume their credentials or other sensitive information may have been compromised. Immediate actions include revoking any active sessions on the legitimate Coinbase platform, enabling multi-factor authentication if not already active, and monitoring accounts for unauthorized transactions. If financial or personal data was entered, affected users should report the incident to relevant financial institutions and consider placing fraud alerts on credit files. The domain is currently offline, but users should remain vigilant for similar impersonation attempts, particularly those leveraging Cloudflare-hosted infrastructure or domains registered through MarkMonitor.