secure--coinbasepro-hub-cdn[.]webflow[.]io

This domain, secure--coinbasepro-hub-cdn.webflow.io, is actively engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the threat type as a credential harvesting phishing operation, designed to deceive users into submitting login credentials through a fraudulent interface. The domain remains operational as of the latest assessment, posing a high risk to unsuspecting users. Infrastructure analysis reveals the domain was registered on May 08, 2013, through MarkMonitor, Inc., a registrar commonly associated with legitimate corporate domains. However, the domain resolves to the IP address 104.18.36.248, which is part of a content delivery network known for hosting both legitimate and malicious content. Security vendor assessments on VirusTotal indicate that 14 out of 95 vendors have flagged this domain as malicious, reflecting moderate but concerning detection coverage. The SSL certificate is issued by Google Trust Services, which, while not inherently suspicious, is frequently exploited by threat actors to lend credibility to phishing sites. Notably, the page title, 'Log in | iTrustCapital,' suggests an attempt to impersonate multiple financial platforms, further indicating a broad-spectrum phishing campaign. The current status of secure--coinbasepro-hub-cdn.webflow.io remains active, with no evidence of takedown or mitigation efforts. Organizations and end-users are advised to block this domain at the network level and implement real-time monitoring for any connections to 104.18.36.248. Security teams should prioritize user education on recognizing brand impersonation tactics, particularly those involving login portals for financial services. Additionally, domain reputation feeds should be updated to include this indicator of compromise, and endpoint protection solutions should be configured to detect and prevent access to the domain. Given the high-risk nature of this infrastructure, immediate action is recommended to mitigate potential credential theft and financial fraud.