coiinbahseexxtension[.]gitbook[.]io

This domain, coiinbahseexxtension.gitbook.io, was identified as a high-risk brand impersonation threat targeting Coinbase. The domain attempts to mimic Coinbase's official extension, potentially misleading users into believing they are interacting with a legitimate service. There is no specific drainer kit detected, but the threat primarily involves credential theft and financial fraud.

Infrastructure analysis reveals that the domain has a VirusTotal score of 14/95, indicating a significant number of security vendors flag it as malicious. The domain is registered through Cloudflare, Inc., and resolves to the IP address 104.18.40.47, which is located in the United States and is part of AS13335, Cloudflare, Inc. The domain was created on March 30, 2014, and is currently flagged by Google Safe Browsing for phishing. It appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services / WE1, which might add a false sense of security to unsuspecting users.

The domain is currently taken offline, and response actions have been initiated to prevent further harm. Despite the offline status, the remaining risk is still considered high due to the potential for the domain to be reactivated or repurposed. Users are advised to verify the legitimacy of any Coinbase-related links or extensions through official channels and to remain vigilant for any signs of impersonation or unauthorized access attempts.