coinbaseprologinv.gitbook.io

Coinbase

https://coinbaseprologinv.gitbook.io Access site

Screenshot

Investigate

Domain coinbaseprologinv.gitbook.io3 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 104.18.40.47

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://coinbaseprologinv.gitbook.io

urlscan

Wayback

archive.today

Cert WE1

crt.sh

Censys

Google CT

Phishunt analysis Beta

38 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+6.1 Google Safe Browsing
+5.3 Keyword match
+5.1 Site cluster
+4.5 Brand in title
+4.1 Brand in screenshot
+3.4 Cert reuse
+3.4 Shared IP cluster
+3.0 OpenPhish
+1.1 ASN reputation
+0.6 Long domain
+0.6 Login text in screenshot
+0.5 Young certificate
+0.3 Free CA
+0.3 Suspicious TLD
+0.1 External scripts
+0.1 Deep subdomain

21 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

This page impersonates Coinbase login on a gitbook.io subdomain to harvest cryptocurrency exchange credentials. It is flagged by Google Safe Browsing for social engineering and by OpenPhish, and shares infrastructure clustering with other known phishing pages hosted on Cloudflare.

Google Safe BrowsingOpenPhishKeyword match

AI-generated from stored detector signals - the AI never visited the site. · 2026-09-27 · confidence 85%

Domain & Network

Whois

Network

IP 104.18.40.47

Country