coiinbase-public-faqs-pro[.]wstd[.]io

The domain coiinbase-public-faqs-pro.wstd.io was registered on February 21, 2026 through NameCheap, Inc. and points to the IP address 104.19.164.34, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated in the United States. The site served an HTTP 401 response and presented a Let’s Encrypt certificate issued by the E8 intermediate, confirming the use of a valid TLS certificate despite its malicious purpose. Google Safe Browsing has classified the domain as a social engineering threat, and the independent blocklist PhishDestroy also listed the domain as malicious.

Additional reputation data show a Gridinsoft trust score of 0 / 100 and detection by 11 of 93 security vendors on VirusTotal, indicating that a notable minority of scanners flagged the host as suspicious. The domain appears on a single public blocklist and is associated with the scam type "Brand Impersonation," suggesting that the operator attempted to mimic a legitimate brand to harvest credentials or other sensitive information. Nameservers for the domain are sandra.ns.cloudflare.com and cosmin.ns.cloudflare.com, both operated by Cloudflare, which is consistent with typical fast‑flux or CDN‑based hosting used by phishing operators.

The current status is offline, but the infrastructure components—Cloudflare IP space, low trust score, and multiple detections—remain active and could be repurposed for future campaigns. Defenders should block the domain and its resolving IP at perimeter defenses, monitor for any resurgence of the host or related sub‑domains, and include the address in threat‑intel feeds. Continuous re‑scanning of the domain and its IP is advised to detect any re‑activation, and any email or web traffic that references the domain should be treated as malicious.