comzbase-sigiin-in[.]gitbook[.]io

The domain comzbase-sigiin-in.gitbook.io is identified as a high-risk brand impersonation threat, currently active. This domain impersonates the brand Base and is designed to deceive users into believing they are interacting with a legitimate Coinbase service. The page title is 'www.Çoinbase.com | Sign In', which closely mimics the official Coinbase sign-in page.

Analysis of the domain reveals that it is flagged by 18 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain is registered through GitBook and resolves to the IP address 104.18.40.47. It appears on three known security blocklists and is specifically flagged by Google Safe Browsing for phishing. The SSL certificate for the domain is issued by Google Trust Services / WE1, which may contribute to user trust. There is no available creation date for the domain, but the active status and multiple flags suggest recent or ongoing malicious activity.

Given the current status of the domain as active and the high risk associated with brand impersonation, it is recommended that organizations and individuals be vigilant and avoid interacting with this domain. Network administrators should consider blocking access to this domain at the network level to protect users. Additionally, security teams should monitor for any related domains or IP addresses that may be part of the same phishing infrastructure. User awareness training should emphasize the importance of carefully verifying URLs, especially when logging into financial accounts.