coinbsseextensionn[.]webflow[.]io

Analysis of coinbsseextensionn.webflow.io indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to IP 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. in the United States, and serves content over Cloudflare with HTTP/3 enabled. A valid SSL certificate issued by Google Trust Services (WE1) is present, providing encrypted transport but not authenticating the underlying content. The site title returned by the server is "Getting Started: Wallet Extension - Coinbase," directly mirroring Coinbase branding, confirming the intent to deceive. Scamadviser assigns a trust score of 1 / 100, and Google Safe Browsing flags the domain for social engineering, both strong indicators of malicious intent.

VirusTotal recorded 16 detections out of 95 scanning vendors, reinforcing the high‑risk classification. The domain is listed on one public security blocklist and has been actively blocked by PhishDestroy. Registration data shows the domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar often used by legitimate enterprises, suggesting possible abuse of a long‑standing registration. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further confirm Cloudflare hosting.

An HTTP 404 response is currently returned, and the status field indicates the site has been taken offline, yet the infrastructure footprint remains observable. Defenders should immediately block the domain at network perimeter and DNS layers, monitor for re‑hosting or related subdomains, and consider adding the domain to internal threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted assets linked to the same IP and registrar may reveal subsequent campaigns. The combination of brand impersonation, low trust score, multiple vendor detections, and Safe Browsing flag makes this domain a confirmed malicious actor targeting Coinbase users.