# coinbase-today-portfolio.gitbook.io — MALICIOUS

> coinbase-today-portfolio.gitbook.io is a crypto drainer domain mimicking Coinbase, flagged by 9/95 VirusTotal security vendors.

## Summary
PhishDestroy identifies coinbase-today-portfolio.gitbook.io as a live crypto drainer masquerading as Coinbase, targeting users through brand impersonation to siphon cryptocurrency assets. This domain presents an elevated risk due to its malicious intent, specifically designed to deceive visitors into divulging sensitive information or authorizing unauthorized transactions. The page title 'Coinbase Pro Login€ | portfolio today|Coinbase©' further reinforces its deceptive purpose, leveraging Coinbase’s branding to appear legitimate.  This domain exhibits multiple red flags across technical and behavioral indicators. VirusTotal security vendors flag this domain with a detection ratio of 9/95, indicating active malicious activity. Additionally, the domain was registered on March 30, 2014, suggesting long-term malicious infrastructure rather than a newly created attack vector. The domain resolves to the IP address 104.18.40.47, which is associated with Cloudflare’s infrastructure, a common tactic to obfuscate the true origin and hosting provider of malicious domains. The SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy, potentially misleading users into trusting the site despite its malicious nature.  Users who have visited or interacted with coinbase-today-portfolio.gitbook.io should immediately cease any further actions, including avoiding credential entry or cryptocurrency transactions. Disconnect from the site and scan devices for potential malware or unauthorized access. If credentials were entered, assume they are compromised and rotate passwords immediately. Report the incident to Coinbase’s support team and monitor accounts for suspicious activity. Consider blocking the domain and its IP address at the network level to prevent further exposure. Always verify URLs and domain spellings before engaging with login pages or financial platforms.

## Threat Details
- Verdict: MALICIOUS
- Site status: cloaking (HTTP ?)
- Target brand: Coinbase
- Page title: Coinbase Pro Login€ | portfolio today|Coinbase©

## Domain Intelligence
- Registered: 2014-03-30 06:09:09
- Registrar: Cloudflare, Inc
- IP: 104.18.40.47

## Detection Status
- VirusTotal: 9 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/8447cc0d-6681-41e2-b17d-7de87701cf89
- PhishDestroy: https://phishdestroy.io/domain/coinbase-today-portfolio.gitbook.io/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-today-portfolio.gitbook.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-today-portfolio.gitbook.io/
Last updated: 2026-04-14