coinbasuiuextension[.]gitbook[.]io

The domain coinbasuiuextension.gitbook.io was registered on April 10, 2026 through Cloudflare, Inc. It resolves to the Cloudflare‑owned IP address 172.64.147.209, which is geolocated to Canada and is served by the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the malicious intent. An HTTP request returns a 403 status, suggesting that the site may be configured to block direct access or to serve content only under specific conditions. VirusTotal analysis shows that 14 of 94 security vendors have flagged the domain, and the site is listed on three external blocklists. Additional defensive feeds, including PhishDestroy, MetaMask, and SEAL, have already blocked the domain. The Gridinsoft trust score of 0/100 further reflects a high confidence of malicious activity. The threat profile is categorized as brand impersonation targeting Coinbase, and the risk level is assessed as high with the domain currently active. No public content or page screenshots have been analyzed, leaving the exact phishing payload or credential‑harvesting mechanisms unknown. Defenders should immediately add the domain to DNS and web‑filter blocklists, monitor outbound connections to the associated IP, and enforce strict TLS inspection to detect any anomalous traffic. Continuous re‑evaluation of threat intelligence feeds is advised to capture any evolution of the campaign.