bookthink[.]my

bookthink.my was observed hosting a page titled “CoinBase Digital Trading Platform” that directly references the Coinbase brand. The domain was registered on December 12, 2025 through Dynadot LLC and uses Cloudflare’s DNS infrastructure (adi.ns.cloudflare.com, razvan.ns.cloudflare.com). It resolves to the IP address 172.67.156.220, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented, indicating the site was served over plain HTTP when it was active.

The site has been taken offline, but historical data show it was flagged by 12 of 95 VirusTotal scanners, listed on one external blocklist, and actively blocked by the PhishDestroy sinkhole. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. The page title and the “Crypto Scam” label in the intelligence point to a cryptocurrency‑related impersonation campaign targeting Coinbase users. The available evidence does not disclose the specific phishing kit or payload used, nor does it reveal any observed credential‑stealing forms.

Consequently, the exact attack vector remains uncertain. Defenders should add the domain and its resolving IP to network‑level blocklists, monitor for any resurgence of the same host header or page title, and enforce TLS inspection to detect future attempts to serve similar content without a certificate. Continuous querying of VirusTotal and other multi‑engine scanners is recommended to capture any new detections, and organizations using Coinbase services should educate users about unsolicited links that reference “CoinBase Digital Trading Platform” and encourage verification of TLS certificates before credential entry.