cbaseprasalogilg[.]gitbook[.]io

The domain cbaseprasalogilg.gitbook.io is currently active and classified as a high‑risk brand‑impersonation site targeting Coinbase users. Analysis shows the site resolves to IP 104.18.40.47, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a legitimate‑looking HTTPS connection. The page title returned by the server is "Çoinbase Pro: Login | us," matching the known brand target of Coinbase and confirming the credential‑phishing intent. VirusTotal records indicate that 14 of 93 security vendors have flagged the domain, and it appears on three public blocklists. Additional defensive feeds have already blocked the domain via PhishDestroy, MetaMask, and SEAL. Infrastructure measurements reveal the use of Cloudflare services and HTTP/3, with nameservers hugh.ns.cloudflare.com and dahlia.ns.cloudflare.com. The domain was created on March 30, 2014 and was registered through Cloudflare, Inc. An HTTP 307 redirect is observed, suggesting the site may forward visitors to additional malicious endpoints. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. Defenders should add the domain to blocklists, monitor for related IP activity, and ensure credential‑monitoring rules are tuned to detect attempts to submit Coinbase credentials to this host. Continuous re‑evaluation is advised as the infrastructure may evolve.