coinibaslotensionie[.]webflow[.]io

The domain coinibaslotensionie.webflow.io is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the domain was designed to mimic Coinbase’s official wallet extension, as evidenced by the page title "Coinbase extension | Wallet is now available as a standalone." The domain is currently offline, but prior activity indicates malicious intent to deceive users into disclosing sensitive credentials or installing fraudulent software. Infrastructure analysis reveals the domain was created on May 8, 2013, though its recent malicious use suggests compromise or repurposing. It resolves to the IPv6 address 2606:4700:440c::ac40:9708, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.) in the United States. The domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. Security vendors flagged the domain as malicious, with 18 out of 95 VirusTotal engines detecting it as phishing. Google Safe Browsing also classified the domain as phishing, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently validate the domain’s legitimacy. Given the domain’s current offline status, immediate active threats are mitigated. However, the historical indicators and infrastructure details warrant caution. Users and organizations are advised to block access to this domain at the network level, monitor for related phishing campaigns, and verify the authenticity of any communications or software claiming affiliation with Coinbase. Security teams should treat this domain as a confirmed malicious indicator and include it in threat intelligence feeds for proactive defense measures.