web-auth-coinbasx[.]webflow[.]io

Analysis of web-auth-coinbasx.webflow.io indicates an elevated‑risk brand‑impersonation campaign targeting Coinbase users. The domain is hosted on Cloudflare (AS13335) and resolves to 172.64.151.8, an IP address located in the United States. DNS records show the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, consistent with the Cloudflare infrastructure. The site is secured with a Google Trust Services certificate issued under the WE1 intermediate, which does not provide any brand‑specific trust but confirms the use of a legitimate TLS provider.

The page returns an HTTP 404 status, and the only visible metadata is the title "Coinbase® Extension® | Getting Started: Wallet Extension," confirming the intent to mimic Coinbase’s browser extension onboarding flow. Registration information lists MarkMonitor, Inc. as the registrar, a service often used for legitimate brand protection, suggesting that the adversary deliberately leveraged a reputable registrar to increase perceived legitimacy. VirusTotal scans have flagged the domain in 16 of 95 security engines, and it appears on a single external blocklist that has already been ingested by PhishDestroy, which currently blocks the host. The campaign is classified as a crypto scam, implying that the adversary likely aims to harvest credentials or seed phrases for illicit fund extraction.

Defenders should update DNS and web‑filtering rules to block both the domain and its resolved IP, monitor for any outbound connections to Cloudflare edge nodes from internal clients, and enforce multi‑factor authentication for Coinbase accounts. Threat‑intel feeds should be enriched with the domain’s creation date (May 08, 2013) and the observed page title to improve detection of similarly crafted impersonation pages. Continuous re‑scanning is recommended, as the 404 response may be a temporary takedown; any future content changes should be re‑evaluated against existing detection signatures.