coinbcxeprolognm[.]gitbook[.]io

The domain coinbcxeprolognm.gitbook.io is flagged for high-risk brand impersonation, specifically targeting Coinbase. The domain impersonates the official Coinbase Pro login page, utilizing a deceptive URL and page title to trick users into divulging their credentials.

Technical analysis reveals that the domain has a VirusTotal score of 18/95, indicating a significant number of security vendors flag it as malicious. The domain is registered through Cloudflare, Inc. and resolves to the IP address 172.64.147.209, which is located in the United States and associated with AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1. The domain was created on February 21, 2026, and is currently flagged by Google Safe Browsing as a phishing site. Additionally, it appears on 3 security blocklists, further confirming its malicious nature.

The domain is currently offline, which indicates that response actions have been taken to mitigate the threat. However, the remaining infrastructure and potential reuse of similar tactics by the threat actors pose a residual risk. Users are advised to remain vigilant and avoid clicking on suspicious links or entering credentials on unfamiliar websites, even if they appear to be legitimate. Security teams should monitor for similar domain registrations and block any related IP addresses or URLs to prevent further attacks.