pro-coinbase-web[.]wstd[.]io

pro-coinbase-web.wstd.io is a subdomain of wstd.io. PhishDestroy first observed the hostname on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “Coinbase Pro login | Getting Started With Pro Coinbase”. Stored page analysis classifies the content as crypto scam. Current evidence score: 92/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, Google Safe Browsing, DNS security resolvers, Cloudflare Radar, and URLScan. VirusTotal recorded 14 detections among 95 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, Google Safebrowsing, Gridinsoft, Kaspersky, Lionic, MalwareURL, SOCRadar, Sophos on Jul 18, 2026 at 18:45 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 2, 2026 at 20:51 UTC. DNS security checks returned 8 blocking results across 14 tested policies: Brand Base, Brand Coinbase, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Coinbase and assigned phishing as its category on Jul 29, 2026 at 03:16 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC.

No conclusive HTTP response was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the registrable domain wstd.io list NameCheap, Inc. as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 104.19.163.34 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Jul 28, 2026 at 02:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt / E8 as the certificate issuer with validity through May 9, 2026; checked Mar 15, 2026 at 08:11 UTC.

The content indicators and 5 positive source findings support the current Coinbase-themed crypto scam classification.