coinbase-gigs-demo[.]webflow[.]io

This domain, coinbase-gigs-demo.webflow.io, is identified as a high-risk brand impersonation infrastructure targeting Coinbase. Analysis indicates the page was designed to mimic legitimate Coinbase services, likely to harvest credentials or distribute fraudulent investment schemes. The page title, "Coinbase Demo," suggests an attempt to deceive users into believing the content is an official or sanctioned demonstration of Coinbase services, a common tactic in phishing operations targeting cryptocurrency platforms.

Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026. It is flagged by Google Safe Browsing as phishing and appears on three security blocklists. VirusTotal reports 17 out of 95 security vendors detect the domain as malicious. No associated IP address or hosting provider details were provided in the initial data, but the subdomain structure (.webflow.io) indicates the use of a third-party website builder platform, which is frequently exploited for rapid deployment of phishing pages.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to its recent creation and known association with phishing campaigns. Organizations and users are advised to monitor for re-emergence of similar domains, enforce blocklist updates, and conduct retrospective log analysis to identify any prior interactions with this domain. Cryptocurrency users should verify all communications and URLs through official Coinbase channels before engaging with any platform-related content.