coinbase-log-waleth[.]gitbook[.]io

The domain coinbase-log-waleth.gitbook.io is currently classified as a high‑risk brand‑impersonation site targeting Coinbase. The page title returned by the server is “Coinbase Wallet - Buy and Sell Bitcoin | Coinbase Wallet - Buy and Sell Bitcoin”, which directly references the Coinbase brand and the cryptocurrency wallet product. Technical analysis shows the domain was created on 30 March 2014 and is hosted behind Cloudflare’s network (ASN 13335, United States). DNS resolution points to 104.18.40.47, and the authoritative nameservers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The site serves over HTTPS with a certificate issued by Google Trust Services (WE1) and negotiates HTTP/3. An HTTP 307 response indicates a temporary redirect, but the underlying content has not been retrieved. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 / 100, Scamadviser 1 / 100, and the domain appears on one security blocklist. VirusTotal reports that 13 of 95 scanning engines flag the domain as malicious. Google Safe Browsing lists the site under the “SOCIAL_ENGINEERING” category, and PhishDestroy has already blocked it. The available intelligence does not include a visual or functional analysis of the landing page, so the exact phishing tactics remain unconfirmed. The redirect behavior and the use of a legitimate‑looking page title suggest an attempt to lure Coinbase users, but without payload capture the full scope cannot be quantified. Defenders should add coinbase-log-waleth.gitbook.io to blocklists at the network perimeter and configure web filtering to deny HTTP 307 redirects to this host. Continuous monitoring of DNS queries for the domain and its IP address is advised, as the underlying infrastructure could be reused for additional campaigns. Incident response teams should treat any traffic to this domain as potentially malicious and investigate related authentication attempts against Coinbase accounts.