coinbase-pseo-demo[.]webflow[.]io

coinbase-pseo-demo.webflow.io is under active investigation as a brand impersonation phishing domain targeting Coinbase users. Observed activity includes social engineering tactics designed to harvest credentials and sensitive financial information under the guise of a legitimate crypto platform.

This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category and is currently blocked by multiple security platforms, including MetaMask and SEAL. The infrastructure hosts the malicious page via Webflow.io and resolves to IP 104.18.36.248, which is served via a valid SSL certificate issued by Google Trust Services. VirusTotal currently shows 0 detections across 95 scans, and the domain appears on two confirmed security blocklists. While hosting has been identified on Cloudflare, key registration details remain obscured through privacy protection, signaling an attempt to evade attribution.

To mitigate exposure to this impersonation scheme, organizations and end-users should block network traffic to coinbase-pseo-demo.webflow.io and 104.18.36.248 at the firewall and DNS levels. Users interacting with Coinbase or similar platforms should verify URL structure—legitimate pages always use coinbase.com—as brand impersonation often relies on subtle typographical deviations. Security teams are advised to push IOCs into SIEM rules and distribute advisories to customer-facing portals to prevent account compromise through credential phishing.