content-coinbaseextensio[.]gitbook[.]io

content-coinbaseextensio.gitbook.io is currently listed as an active brand‑impersonation site targeting Coinbase. The domain was registered on 21 February 2026 through Cloudflare and resolves to 172.64.147.209, an IP address owned by Cloudflare (AS13335) located in the United States. Google Safe Browsing has marked the site with a SOCIAL_ENGINEERING warning, and it appears on at least one public blocklist, including PhishDestroy. Infrastructure analysis shows the site is hosted on the GitBook platform and served over a Google‑issued TLS certificate (Google Trust Services / WE1). HTTP requests receive a 307 temporary redirect, and the server advertises HSTS, HTTP/3, and Cloudflare‑enabled CDN services such as Google Cloud CDN. Additional client‑side technologies include Google Tag Manager, LinkedIn Ads, and the GitBook content management system. Threat intelligence indicates that 13 out of 95 security vendors on VirusTotal have flagged the domain as malicious, and the Gridinsoft trust score is 0 out of 100. The page title reported by scanners is simply “GitBook,” which aligns with the hosting platform but provides no legitimate branding. The domain’s sole purpose appears to be cryptocurrency‑related fraud, as indicated by the classified scam type, and it directly impersonates Coinbase to lure victims. Defenders should block the domain at network perimeter and update endpoint allow‑lists to include the IP 172.64.147.209 as malicious. Email gateways and web filters must treat any URLs containing “coinbaseextensio” as suspicious and apply additional verification steps. Incident response teams should monitor for credential‑stealing attempts or wallet address disclosures that reference Coinbase, and users should be educated to verify TLS certificates and avoid interactions with sites that present only generic page titles like “GitBook.”