coin-besepro-login[.]gitbook[.]io

This domain, coin-besepro-login.gitbook.io, operates as a phishing portal designed to impersonate the official Coinbase Pro login interface. The site presents a fraudulent login page titled 'Çoinbase Pro Login,' tricking users into entering their credentials, which are then harvested by threat actors. The primary threat is credential theft, enabling unauthorized access to cryptocurrency accounts and financial fraud. Secondary risks include potential malware distribution or follow-up social engineering attacks using stolen data. Analysis indicates the domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on IP address 172.64.147.209, associated with AS13335 (Cloudflare, Inc.). At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Google Safe Browsing has also classified the domain as phishing infrastructure. If you visited coin-besepro-login.gitbook.io or entered any credentials, immediately revoke access to any linked accounts and enable multi-factor authentication (MFA) using a non-SMS method. Change passwords for all accounts where the same credentials may have been reused, prioritizing financial and cryptocurrency platforms. Monitor accounts for unauthorized transactions and report the incident to the impersonated service (Coinbase) for further mitigation. Avoid interacting with any communications claiming to be from Coinbase that reference this domain, as they may be follow-up phishing attempts.