coinbasewlltextension[.]gitbook[.]io

The domain coinbasewlltextension.gitbook.io is currently active and flagged as a high‑risk brand‑impersonation site targeting Coinbase users. Registration details show the domain was created on March 30, 2014 and is hosted behind Cloudflare, Inc., with both authoritative name servers (dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com) resolving to the IP address 172.64.147.209, which belongs to AS13335 (Cloudflare) in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS connection, yet the HTTP response is a 307 redirect, a pattern often used to funnel traffic to malicious payloads. The page title captured from the site – "ÇoinƂase Walletↈextension | Your ƙey to the world of crypto" – explicitly references Coinbase and suggests a wallet extension, reinforcing the impersonation claim.

VirusTotal analysis reports that 15 of 95 security vendors have flagged the domain, demonstrating a moderate consensus of malicious intent. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, providing additional evidence of its abusive nature. Independent reputation services assign extremely low trust scores: Gridinsoft rates the site at 0 / 100 and Scamadviser at 1 / 100, confirming the lack of legitimacy. The identified scam type is a crypto scam, consistent with the use of Coinbase branding to lure victims.

While the underlying infrastructure (Cloudflare, HTTP/3) is common for legitimate services, the combination of brand‑spoofing page title, low trust scores, vendor detections, and active blocklist entries indicates a deliberate attempt to deceive users. Uncertainty remains regarding the specific payload or phishing workflow employed after the redirect, as no additional content analysis is available. Defenders should immediately block the domain at network perimeters, update URL filtering and endpoint protection rules to include the IP 172.64.