coinbaseprologinnn[.]gitbook[.]io

This domain represents a high-risk brand impersonation threat specifically designed to mimic the official Coinbase Pro login interface. Analysis of the page title, Çóinbase® Pró Lógin | Lógin, reveals deliberate character substitution and branding elements intended to deceive users into entering credentials on a fraudulent platform. The domain targets cryptocurrency account holders by presenting a visually convincing replica of legitimate login pages, increasing the likelihood of credential theft and subsequent unauthorized access to digital asset wallets or trading accounts. Infrastructure analysis provides concrete evidence of malicious intent. The domain was registered on February 27, 2026, through Cloudflare, Inc., and resolves to the IP address 104.18.40.47, hosted on Cloudflare’s network (AS13335). Security validation shows 17 out of 95 engines on VirusTotal flagging the domain as malicious, while it appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), further obfuscates the fraudulent nature by providing a false sense of security through encryption. Google Safe Browsing has explicitly classified this domain as phishing, reinforcing its threat classification. Users who accessed or entered credentials on coinbaseprologinnn.gitbook.io should immediately take corrective action. All passwords associated with Coinbase or related financial accounts must be changed from a secure, unrelated device. Multi-factor authentication should be enabled if not already active, and account activity should be reviewed for unauthorized transactions. If cryptocurrency transfers or suspicious logins are detected, affected users should report the incident to the targeted platform’s security team and consider filing a report with relevant cybercrime authorities. Monitoring for follow-up phishing attempts via email or SMS is strongly advised, as compromised credentials may be used in subsequent attacks.