coinbase-today-portfolio[.]gitbook[.]io

PhishDestroy identifies coinbase-today-portfolio.gitbook.io as a live crypto drainer masquerading as Coinbase, targeting users through brand impersonation to siphon cryptocurrency assets. This domain presents an elevated risk due to its malicious intent, specifically designed to deceive visitors into divulging sensitive information or authorizing unauthorized transactions. The page title 'Coinbase Pro Login€ | portfolio today|Coinbase©' further reinforces its deceptive purpose, leveraging Coinbase’s branding to appear legitimate. This domain exhibits multiple red flags across technical and behavioral indicators. VirusTotal security vendors flag this domain with a detection ratio of 9/95, indicating active malicious activity. Additionally, the domain was registered on March 30, 2014, suggesting long-term malicious infrastructure rather than a newly created attack vector. The domain resolves to the IP address 104.18.40.47, which is associated with Cloudflare’s infrastructure, a common tactic to obfuscate the true origin and hosting provider of malicious domains. The SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy, potentially misleading users into trusting the site despite its malicious nature. Users who have visited or interacted with coinbase-today-portfolio.gitbook.io should immediately cease any further actions, including avoiding credential entry or cryptocurrency transactions. Disconnect from the site and scan devices for potential malware or unauthorized access. If credentials were entered, assume they are compromised and rotate passwords immediately. Report the incident to Coinbase’s support team and monitor accounts for suspicious activity. Consider blocking the domain and its IP address at the network level to prevent further exposure. Always verify URLs and domain spellings before engaging with login pages or financial platforms.