coinbsewltension[.]webflow[.]io

The domain coinbsewltension.webflow.io is currently flagged as a high‑risk generic phishing site. Infrastructure analysis shows it resolves to the IP address 172.64.151.8, which is part of the Cloudflare network commonly used by Webflow‑hosted sites. Registration data indicates the domain was created through Webflow, Inc., and no authoritative nameserver information is available (NS_NOT_FOUND). Google Safe Browsing classifies the URL as social engineering, and five of ninety‑one security vendors on VirusTotal have reported malicious activity, confirming that the domain is recognized by multiple independent scanners.

It also appears on at least one external blocklist and has been blocked by the PhishDestroy service, reinforcing its malicious reputation. The threat type is recorded as generic phishing, and the risk level is high, with the status listed as active. Evidence gaps remain: the site’s SSL certificate details, HTTP response codes, and page title have not been disclosed, so the exact content and any additional indicators cannot be confirmed at this time. Defenders should treat the domain as malicious until further analysis proves otherwise.

Recommended mitigations include adding the domain to URL filtering and DNS blocklists, enforcing outbound web traffic controls to prevent user access, and monitoring for any connections to the associated IP address. Continuous feed updates from Google Safe Browsing, VirusTotal, and PhishDestroy should be incorporated into security tooling to maintain visibility. Organizations using Webflow‑based assets should also review internal policies for allowing user‑generated subdomains, as the platform’s ease of deployment can be abused for phishing campaigns.