coinxbase-pro-logien[.]gitbook[.]io

Analysis of coinxbase-pro-logien.gitbook.io shows it is an active infrastructure used for brand impersonation of Base. The domain, registered on March 30, 2014, resolves to the Cloudflare‑hosted IP address 172.64.147.209, which belongs to AS13335 in the United States. DNS resolution uses Cloudflare nameservers (hugh.ns.cloudflare.com, dahlia.ns.cloudflare.com) and the site serves an SSL certificate issued by Google Trust Services under the WE1 profile. HTTP traffic is observed over HTTP/3 and returns a 403 status code. Reputation data indicates a Gridinsoft trust score of 0/100 and that the domain appears on two security blocklists, specifically PhishDestroy and PhishingDB. Google Safe Browsing flags the site for social engineering, and VirusTotal reports that 15 of 93 scanned security vendors classify the domain as malicious. The site is listed on additional blocklists and remains reachable. While the exact phishing page content has not been publicly disclosed, the convergence of Cloudflare hosting, a low trust score, multiple vendor detections, and explicit Google Safe Browsing labeling confirms a high‑risk impersonation campaign. Defenders should block the domain at network perimeters, update URL filtering and endpoint protection rules, and monitor DNS queries for the associated IP and Cloudflare nameservers. Ongoing observation is recommended to detect any changes in hosting or content that could affect mitigation strategies.