u-sso-coinbase-auth-m-auth[.]webflow[.]io

Analysis of the domain u-sso-coinbase-auth-m-auth.webflow.io confirms it as a high-risk phishing site targeting Coinbase users, operational since February 21, 2026. The domain was registered through NameCheap, Inc., and leverages Cloudflare infrastructure, resolving to IP 104.18.36.248 (AS13335, Cloudflare, Inc., US). Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further indicate Cloudflare hosting, a common tactic to obscure origin and evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections, which may lend a false sense of legitimacy to victims. The page title, 'Official Site® | Coinbase Pro | Digital Asset Exchange®,' explicitly impersonates Coinbase, a well-documented tactic in crypto-focused phishing campaigns.

Detection data supports this classification: the domain appears on three security blocklists and is flagged by 17 of 93 security vendors on VirusTotal. Blocking by PhishDestroy, MetaMask, and SEAL further corroborates its malicious intent. The scam type is classified as a crypto scam, though the exact mechanics—whether credential harvesting, wallet-draining scripts, or fraudulent token offers—remain unconfirmed due to the site's current offline status (HTTP 404). Infrastructure analysis reveals the use of HTTP/3, a protocol choice that may aid in bypassing legacy security controls.

The domain's creation date aligns with a period of heightened phishing activity targeting cryptocurrency platforms, though no direct links to other campaigns or threat actors are established in available intelligence. Defenders should treat this domain as actively malicious, prioritizing its inclusion in blocklists, email filtering rules, and endpoint protection signatures. Given the use of Cloudflare, takedown efforts may require coordination with the hosting provider to fully neutralize the threat.