helps-coinbaes-extso[.]webflow[.]io

This domain, helps-coinbaes-extso.webflow.io, is identified as a high-risk phishing site specifically designed to impersonate Coinbase Wallet. Analysis of the page title, "Coinbase® Extension® | Getting Started: Wallet Extension," indicates an intent to deceive users into downloading a malicious browser extension under the guise of a legitimate Coinbase product. The domain mimics the branding and functionality of Coinbase’s official wallet extension, a tactic commonly used to harvest credentials, private keys, or install malware on victim devices. The threat primarily targets cryptocurrency users, exploiting trust in the Coinbase brand to facilitate unauthorized access to digital assets or personal information. Technical evidence confirms the malicious nature of this domain. The domain is flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread detection as a phishing threat. It was registered through MarkMonitor, Inc. on May 8, 2013, though the specific subdomain activity suggests recent malicious repurposing. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to mask the true origin of the attack. The domain appears on two security blocklists and is explicitly flagged by Google Safe Browsing as a phishing site. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. Users who visited helps-coinbaes-extso.webflow.io or interacted with its content should take immediate action to mitigate potential compromise. If any credentials, recovery phrases, or private keys were entered, these should be considered exposed and revoked immediately. Users are advised to scan their devices for malware using updated security tools, as the site may have distributed malicious payloads. All cryptocurrency wallets associated with the device should be audited for unauthorized transactions. Additionally, users should enable multi-factor authentication on all financial and cryptocurrency accounts to prevent further unauthorized access. Monitoring for suspicious activity, such as unexpected login attempts or transactions, is critical in the days following exposure.