conebesgxtensione[.]webflow[.]io

Analysis indicates that the subdomain conebesgxtensione.webflow.io was provisioned on May 08, 2013 and is registered through MarkMonitor, Inc. The site resolves to the Cloudflare edge address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc., and the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS handshake is performed by Google Trust Services (WE1), confirming that the connection is encrypted but does not imply legitimacy. HTTP requests return a 404 status, and the page title observed in prior captures reads “Getting Started: Wallet Extension – Coinbase – Official”, directly referencing the Coinbase brand. This aligns with the declared scam type of a crypto scam and the impersonation target of Coinbase.

Google Safe Browsing classifies the URL as a social engineering threat, and PhishDestroy has listed the domain as blocked. Scamadviser assigns a trust score of 1 out of 100, and the domain appears on at least one security blocklist. VirusTotal analysis shows that 16 of 95 scanning engines flag the domain as malicious. The site was reported as taken offline at the time of this investigation.

Uncertainty remains regarding the exact content served before the 404 response, as no live page was captured. The presence of Cloudflare and HTTP/3 indicates a modern hosting stack, but these technologies are commonly abused by threat actors. Defenders should immediately block the domain and its associated IP address at perimeter defenses, incorporate the domain into threat‑intel feeds, and monitor for any future re‑registration or resurrection of the subdomain. Ongoing vigilance is advised, especially for users of Coinbase services, to prevent credential harvesting attempts that may leverage the observed page title and brand impersonation.