sso--create--coinbasepro--eng---auth[.]webflow[.]io

The domain sso--create--coinbasepro--eng---auth.webflow.io, impersonating Coinbase, has a critical threat score of 95/100 and is currently down. It has been flagged as malicious by 11 out of 95 security vendors, including notable names like BitDefender and Kaspersky, and is listed on one public blocklist. Google Safe Browsing has not flagged this domain, indicating it may have been recently taken down without widespread awareness.

Registered with MarkMonitor, Inc., the domain was created on May 8, 2013, and its first detection date is recorded as December 12, 2025. The hosting IP is 172.64.151.8, which may require further investigation for associated threats. Given the critical threat level, block the domain at the perimeter and submit a report to the registrar's abuse desk.