coinbase-login-and-sigin[.]gitbook[.]io

The domain coinbase-login-and-sigin.gitbook.io was registered on February 21, 2026 and is presently taken offline. It hosts a page whose title reads "Coinbase Login and Sign In – Secure Access to Your Crypto Trading Account | coinbase-login-and-sigin Docs", clearly targeting the Coinbase brand. DNS resolution points to IP address 172.64.147.209, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site employed Cloudflare services, including HTTP/3, and presented an SSL certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS chain but offering no assurance of legitimacy.

HTTP responses returned a 403 status code, suggesting the content was inaccessible at the time of testing. The domain is listed on three security blocklists and is flagged by Google Safe Browsing for social engineering. It has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded 16 detections out of 91 scanning engines, reinforcing the malicious classification.

Registration was performed through Cloudflare, Inc., and the authoritative nameservers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. No additional infrastructure details, such as backend scripts or additional IPs, were observed. Defenders should immediately add the domain and its resolved IP to network deny lists, update intrusion detection signatures to capture Cloudflare‑hosted impersonation attempts, and monitor for newly registered subdomains that reference Coinbase. Continuous observation of Cloudflare‑registered domains targeting cryptocurrency services is advised, as the provider’s flexible DNS can enable rapid deployment of similar impersonation sites.