extension-coerinbase[.]webflow[.]io

The domain extension-coerinbase.webflow.io is identified as engaging in brand impersonation, specifically targeting Coinbase. This domain does not appear to utilize any known drainer kits, but it poses a significant threat through its phishing activities.

Infrastructure analysis reveals that the domain has a VirusTotal score of 12/95, indicating a notable level of detection by security vendors. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8, which is located in the United States and associated with Cloudflare, Inc. The domain was created on May 08, 2013, and is currently flagged by Google Safe Browsing as a phishing site. It appears on 1 security blocklist, notably PhishDestroy, further corroborating its malicious nature.

The domain extension-coerinbase.webflow.io has been taken offline, reducing the immediate risk to web users. However, the possibility of the domain being reactivated or repurposed for future attacks remains. It is recommended that affected parties continue to monitor the domain and update their security policies to prevent access to similar impersonation sites. Additionally, users should be cautious of any communications or links that purport to be from Coinbase and verify the authenticity of such content through official channels.