coinbscewallct[.]gitbook[.]io

This domain, coinbscewallct.gitbook.io, is flagged as a high-risk brand impersonation threat targeting Coinbase. The domain was created on May 11, 2026, and is currently active, presenting itself with the page title 'Coinbase Wallet - Your key to the world of crypto.' This impersonation is designed to deceive users into believing they are interacting with the official Coinbase Wallet, a trusted cryptocurrency management tool. Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc., and is hosted on an IP address (104.18.40.47) managed by Cloudflare, which is a common choice for legitimate and malicious sites alike. The domain utilizes advanced web technologies including GitBook, Google Cloud, HSTS, Google Cloud Trace, and HTTP/3, which can lend an air of legitimacy to the site. However, the SSL certificate is issued by Google Trust Services, which, while a reputable authority, does not inherently validate the site's legitimacy in this context. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trustworthiness. Additionally, the domain appears on three security blocklists and has been flagged by 19 out of 95 security vendors on VirusTotal, further confirming its malicious nature. Defenders should be vigilant and consider this domain a significant threat. Users should be advised to verify the authenticity of any Coinbase-related links they encounter, ensuring they are accessing the official Coinbase Wallet through verified channels. Security teams should monitor for any attempts to distribute this link via phishing emails or social media and take proactive measures to block or report it. The combination of a low trust score, multiple security flags, and the use of sophisticated hosting and web technologies underscores the importance of maintaining robust defense mechanisms against such impersonation attacks.