help-coinbaswalext[.]gitbook[.]io

The domain help-coinbaswalext.gitbook.io has been identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis confirms the domain is currently offline, though it previously hosted content designed to deceive visitors into believing they were interacting with legitimate Coinbase wallet extension services. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Cloudflare, Inc. and resolved to the IP address 104.18.40.47, hosted on Cloudflare’s network (AS13335). The domain was created on March 30, 2014, though recent activity suggests it was repurposed for fraudulent use. It appears on at least one security blocklist and was previously flagged by Google Safe Browsing as phishing. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to malicious domains. Given the domain’s current offline status, no active threat is present, but historical activity warrants caution. Organizations and users are advised to block the domain at the network level, monitor for related infrastructure (e.g., subdomains or similar naming patterns), and verify all wallet extension downloads exclusively through official Coinbase channels. Security teams should review logs for prior connections to 104.18.40.47 or the domain itself to assess potential exposure.