coinbasewalletaxtension[.]webflow[.]io

This domain, coinbasewalletaxtension.webflow.io, was designed to trick people into thinking it was a legitimate Coinbase wallet extension page. Instead, it was a brand impersonation phishing site aimed at stealing login credentials or other sensitive information from Coinbase users. The site has since been taken offline, but anyone who visited it before its removal may still be at risk.

PhishDestroy’s analysis uncovered several red flags. The domain was created on February 21, 2026, and registered through NameCheap, Inc. It resolved to IP address 104.18.36.248 and used an SSL certificate from Google Trust Services. However, appearances were deceptive: Google Safe Browsing flagged it for phishing, and a scan on VirusTotal showed that 16 out of 95 security vendors recognized it as malicious. The site also appeared on three security blocklists, confirming its dangerous nature.

If you visited this site and entered any personal information—such as your Coinbase username, password, or two-factor authentication codes—you should change your Coinbase password immediately and enable two-factor authentication if you haven’t already. Contact Coinbase support to alert them of potential compromise and monitor your account for any unauthorized activity. It’s also wise to run a full security scan on your device and avoid reusing passwords across sites. Staying vigilant against such impersonation attempts is key to protecting your digital assets.