cois-web-en-auh[.]pineapple[.]page

The domain cois-web-en-auh.pineapple.page was observed serving a page titled "Coinbase - Sign In" and is classified as a brand impersonation targeting Coinbase. Infrastructure analysis shows the domain resolves to IP address 216.150.1.65, which belongs to ASN 16509 operated by Amazon.com, Inc., and is geolocated in the United States. The hosting provider is Vercel, as indicated by both the registration metadata (registered through Vercel Inc.) and the detection of Vercel technology on the site. The site employed HTTPS with a Let’s Encrypt certificate (R13) and advertised HTTP Strict Transport Security (HSTS), yet the HTTP response code was 200, indicating the page was reachable before being taken offline.

Reputation services flag the domain as highly suspicious: Scamadviser assigned a trust score of 1 out of 100, Gridinsoft reported 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and Google Safe Browsing categorises it under social engineering. VirusTotal scans recorded 15 detections out of 95 security vendors, reinforcing the malicious assessment.

The site is currently offline, but historical evidence confirms it was used for a cryptocurrency‑related scam impersonating Coinbase. Defenders should continue to block the domain at network perimeter devices, monitor for any resurgence of the same IP or hosting account, and update detection rules to include the observed page title and SSL fingerprint. Further investigation is warranted to determine whether additional subdomains or related Vercel projects share the same infrastructure, as such patterns often indicate broader campaign activity.