Phishing detection: coinbaseprolilogin.gitbook.io

Coinbase
https://coinbaseprolilogin.gitbook.io Access site
Screenshot
Screenshot of coinbaseprolilogin.gitbook.io
Investigate
Domain coinbaseprolilogin.gitbook.io2 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 104.18.40.47
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://coinbaseprolilogin.gitbook.io
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
26 low suspicionheuristic risk score · not a probability
Keyword matchOpenPhishSite cluster
15 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Coinbase Pro login phishing page on GitBook displaying Coinbase branding and explicit login prompts targeting cryptocurrency account credentials. Flagged by OpenPhish with a redirect chain observed prior to the final landing page.

Brand in screenshotLogin text in screenshotOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 82%
Domain & Network
Whois
Network
IP 104.18.40.47
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert -
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
coinbase-pro-login-6.gitbook.io 33 same apex same nameservers similar name
active 2026-07-23
facebook-com.gitbook.io 27 same apex same nameservers similar name
active 2026-07-10
metamasklskog.gitbook.io 27 same apex same nameservers similar name
active 2026-07-12
Top 3 of 3 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-23 13:02 UTC  ·  Last refreshed 2026-08-02 07:30 UTC