en--sso--p-coinbasepro---auth-cdn[.]webflow[.]io

This domain is classified as a high-risk brand impersonation threat targeting Coinbase Pro users. Analysis indicates the domain mimics the official Coinbase Pro authentication portal, designed to harvest login credentials, API keys, or two-factor authentication codes from unsuspecting users attempting to access digital asset exchange services. Infrastructure analysis reveals the domain en--sso--p-coinbasepro---auth-cdn.webflow.io was registered through MarkMonitor, Inc. on May 08, 2013, though recent malicious activity suggests compromise or repurposing. The domain resolves to IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.) infrastructure in the United States. Google Safe Browsing explicitly flags this domain as phishing, while VirusTotal reports 18 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist and uses an SSL certificate issued by Google Trust Services (WE1). The page title, 'Official Site® | Coinbase Pro | Digital Asset Exchange®,' reinforces the impersonation attempt by closely mirroring legitimate branding. Mitigation requires immediate blocking of the domain and associated IP address (172.64.151.8) at network perimeter devices. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, email gateways, and web proxies. Users who may have interacted with the domain should be instructed to reset credentials, revoke API keys, and enable multi-factor authentication on all financial and cryptocurrency exchange accounts. Monitoring for anomalous login attempts or unauthorized transactions is critical, particularly for accounts linked to Coinbase or Coinbase Pro services. Organizations should review logs for connections to the domain or IP address to identify potential compromise.