consbseprolognx[.]gitbook[.]io

The domain consbseprolognx.gitbook.io is actively hosting a credential phishing page, as indicated by the page title "Çoinbase Pro Login | Çoinbase Pro Login" and the classified scam type of credential phishing. Infrastructure analysis shows the domain was registered on February 21, 2026 and resolves to the IP address 172.64.147.209, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States. The site is served over HTTPS using a Google Trust Services / WE1 certificate and employs Cloudflare and HTTP/3 technologies, returning an HTTP 307 redirect on request. Threat intelligence sources have listed the domain on two blocklists, specifically PhishDestroy and PhishingDB, and VirusTotal reports that 16 of 93 security vendors have flagged the domain, reinforcing its malicious reputation. The Gridinsoft trust score of 0 / 100 further indicates a lack of trust. While the exact content of the page has not been examined, the combination of a targeted login‑style title, low trust scores, and multiple vendor detections suggests the site is designed to harvest credentials from users seeking access to a well‑known financial service. Uncertainty remains regarding the presence of any additional malicious payloads or exfiltration mechanisms beyond credential capture. Defenders should block DNS resolution for consbseprolognx.gitbook.io, incorporate the IP 172.64.147.209 into network‑level deny lists, and monitor for any outbound connections to this address. Continuous re‑evaluation of the domain's status on threat feeds is recommended, as the infrastructure could be repurposed or expanded.