coinabesperologinunqz[.]gitbook[.]io

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase users through a fraudulent login interface. Analysis indicates the page mimics Coinbase Pro authentication portals, likely designed to harvest credentials or facilitate unauthorized account access. The threat type aligns with credential theft campaigns commonly deployed against cryptocurrency exchange users. Infrastructure analysis reveals the domain coinabesperologinunqz.gitbook.io was created on May 12, 2026, and registered through GitBook. It resolves to the IP address 104.18.40.47, geolocated to Cloudflare infrastructure in Canada. Security vendor detections on VirusTotal report 16 out of 95 engines flagging the domain as malicious. The domain appears on three security blocklists, and its SSL certificate is issued by Google Trust Services (WE1). The page title explicitly references Coinbase Pro Login@ | us, reinforcing its impersonation intent. Current status indicates the domain has been taken offline, though prior activity remains a documented risk. Mitigation against such brand impersonation threats involves verifying domain authenticity before entering credentials. Users should cross-check URLs against official exchange domains and enable multi-factor authentication on all financial accounts. Organizations should monitor for unauthorized access patterns linked to this domain or its associated IP. Security teams are advised to update blocklists with the provided indicators, including the domain, IP, and SSL certificate issuer, to prevent future exposure to this campaign.