coinbasewalleteawxtension[.]webflow[.]io

Analysis on July 23, 2026 identifies the domain coinbasewalleteawxtension.webflow.io as an active brand‑impersonation infrastructure targeting Coinbase users. The site was registered on May 08 2013 through MarkMonitor, Inc., and is hosted on Cloudflare’s network (AS13335) with the IP address 104.18.36.248 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the reliance on Cloudflare’s edge services. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration despite the malicious intent.

The HTTP response for the root URL returns a 404 status, and the page title reported by scanners reads “Getting Started: Wallet Extension – Coinbase,” which aligns with the declared scam type of a crypto scam and the impersonation of Coinbase’s wallet extension. The domain appears on a single security blocklist and has been flagged by PhishDestroy, demonstrating that at least one defensive feed has taken action. VirusTotal scans show that 13 of 93 security vendors marked the domain as malicious, reinforcing the suspicion of abuse. Scamadviser assigns a trust score of 1 out of 100, reflecting an extremely low reputation.

Current monitoring indicates the domain is offline, suggesting the operators have withdrawn the site or are temporarily re‑hosting elsewhere. However, the underlying infrastructure—Cloudflare hosting, a valid Google‑issued certificate, and the same IP address—remains reusable for future campaigns. Defenders should continue to block the domain at DNS and proxy layers, add the IP 104.18.36.248 to any deny lists, and monitor for re‑appearance of similar subdomains under the webflow.io namespace.