coinbceprologim[.]gitbook[.]io

The domain coinbceprologim.gitbook.io was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to IP address 172.64.147.209, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served through Cloudflare’s DNS infrastructure, using nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, and was registered via Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 hierarchy, indicating a legitimate certificate chain despite the malicious intent.

HTTP responses return a 403 status code, suggesting the site is inaccessible at the time of analysis, yet historical snapshots indicate the page title "Çoinbase Pro: Login," confirming an attempt to impersonate Coinbase’s professional trading platform. The campaign is classified as a crypto scam targeting Coinbase users, and security vendors have flagged the domain: 16 of 93 VirusTotal scanners flagged it, Google Safe Browsing labels it as social engineering, and it appears on three external blocklists. Additional defensive feeds, including PhishDestroy, MetaMask, and SEAL, have already listed the domain as malicious.

Defenders should update web filtering and DNS sinkhole rules to block coinbceprologim.gitbook.io and its associated IP 172.64.147.209, enforce certificate pinning for Coinbase services, and monitor for any resurgence of the host under new subdomains. Continuous telemetry from endpoint protection platforms should be tuned to trigger alerts on any attempted connections to this domain or its Cloudflare‑hosted infrastructure, and incident response teams should be prepared to investigate any credential‑theft reports that reference a Coinbase‑styled login page.