sso--en--coinbasepro--cdn---m--auth[.]webflow[.]io

Analysis of the domain sso--en--coinbasepro--cdn---m--auth.webflow.io indicates a high-risk crypto scam targeting Coinbase users. The domain, registered on March 3, 2026, through Webflow, was taken offline by July 23, 2026, returning an HTTP 404 status. It previously resolved to IP 104.18.36.248 (AS13335 Cloudflare, Inc., US) and used a Google Trust Services SSL certificate (WE1). The page title, 'Official Site® | Coinbase Pro | Digital Asset Exchange®,' explicitly impersonates Coinbase Pro, aligning with the reported scam type of crypto fraud.

Detection data shows the domain appeared on three security blocklists, and 18 of 94 VirusTotal vendors flagged it as malicious. Blocking actions were recorded by PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals Cloudflare hosting and HTTP/3 support, common for phishing sites due to its ease of deployment and obfuscation capabilities.

While the domain is currently offline, defenders should treat any prior or future resolutions of this domain as malicious. Network security teams are advised to block the domain and its resolved IP at perimeter defenses, and to monitor for related subdomains or re-registrations under different TLDs. The exact content of the phishing page remains unanalyzed, but the combination of brand impersonation, crypto scam classification, and detection by multiple security vendors confirms its malicious intent.