conn-en-oaths[.]pineapple[.]page

This domain, conn-en-oaths.pineapple.page, is identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to replicate the Coinbase Pro login interface, as evidenced by the page title Coinbase™ Pro Login - Access Crypto Safely. The infrastructure supports a fake login portal, likely intended to harvest user credentials for unauthorized access to cryptocurrency accounts. No direct evidence of a crypto drainer kit was observed, but the credential harvesting mechanism aligns with common phishing tactics used to facilitate subsequent financial fraud or account takeovers. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. It was registered through Vercel Inc. and resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The domain appears on one security blocklist, and its creation date aligns with recent phishing campaign patterns targeting financial services. The page title and branding elements closely mimic Coinbase’s official design, increasing the likelihood of successful deception. As of the latest assessment, conn-en-oaths.pineapple.page has been taken offline, reducing immediate exposure to end users. However, the domain remains a residual risk due to its registration status and historical malicious activity. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor financial transactions for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of similar domains registered through Vercel Inc. or resolving to the same IP range is recommended to mitigate related threats.