coinebaseextansion[.]gitbook[.]io

Analysis of coinebaseextansion.gitbook.io indicates that the domain is actively used for phishing and is currently classified as high‑risk. The domain appears on two security blocklists and is blocked by multiple security extensions, confirming its malicious reputation. Registration was performed through Cloudflare, Inc., with authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The domain was created on 30 March 2014 and resolves to IP address 104.18.40.47, which is hosted behind Cloudflare’s edge network. TLS is provided by Google Trust Services, showing a valid certificate chain but offering no mitigation against the underlying malicious activity. VirusTotal scans show that 10 of 91 security vendors have flagged the domain, reinforcing the suspicion of phishing behavior. While the specific phishing kit, targeted brand, or page content has not been publicly disclosed, the convergence of blocklist presence, vendor detections, and active blocking by security tools provides sufficient evidence to treat the domain as a confirmed phishing infrastructure. Defenders should block DNS resolution to 104.18.40.47, add the domain to web‑filter deny lists, and monitor for any related C2 traffic. Continuous re‑evaluation is advised should additional indicators emerge.