Phishing detection: coinbase-pro-login-6.gitbook.io

Coinbase
http://coinbase-pro-login-6.gitbook.io/coinbaseprologin Access site
Screenshot
Screenshot of coinbase-pro-login-6.gitbook.io
Investigate
Domain coinbase-pro-login-6.gitbook.io2 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 104.18.40.47
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://coinbase-pro-login-6.gitbook.io/coinbaseprologin
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
30 low suspicionheuristic risk score · not a probability
Keyword matchBrand in subdomainBrand + login token
17 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Coinbase Pro login phishing page on GitBook using a combosquatted hyphenated subdomain. Displays Coinbase branding with prominent login prompts and is flagged by OpenPhish, targeting cryptocurrency account credentials.

Brand + login tokenBrand in subdomainLogin text in screenshot
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 86%
Domain & Network
Whois
Network
IP 104.18.40.47
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert -
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
coinbaseprolilogin.gitbook.io 33 same apex same nameservers similar name
active 2026-07-23
facebook-com.gitbook.io 27 same apex same nameservers similar name
active 2026-07-10
metamasklskog.gitbook.io 27 same apex same nameservers similar name
active 2026-07-12
Top 3 of 3 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-23 13:02 UTC  ·  Last refreshed 2026-08-02 07:30 UTC