home-coibse-en[.]pineapple[.]page

On July 23, 2026, the domain home-coibse-en.pineapple.page was observed serving a web page titled “Coinbase Pro Login™ | Secure® Access for Traders╔”. The page title explicitly references Coinbase, confirming a Coinbase brand impersonation attempt. The site was hosted on Vercel infrastructure, as indicated by the technology fingerprint, and enforced HTTP Strict Transport Security (HSTS). DNS resolution returned the IPv4 address 216.150.1.1, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. A publicly‑trusted Let’s Encrypt certificate (R13) was presented, and the HTTP response code was 200, suggesting the site was reachable before being taken offline.

Reputation data shows the domain was blocked by PhishDestroy and appears on a single security blocklist. Google Safe Browsing classified it as a social‑engineering threat. VirusTotal scans recorded 15 detections out of 95 security‑vendor engines, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 0 out of 100, and the overall risk rating was marked high. The registrar information lists Vercel Inc. as the registrar; nameserver data was not available (NS_NOT_FOUND).

The available evidence confirms that the infrastructure was deliberately crafted to lure Coinbase users into entering credentials, but the site is currently offline, limiting immediate exposure. Open questions remain regarding the duration the domain was active, the specific phishing kit employed, and whether additional infrastructure (e.g., command‑and‑control or data‑exfiltration servers) is associated with the same IP range. Defenders should continue to monitor for residual artifacts, such as emails containing the domain, and ensure that any credentials submitted to the URL are considered compromised. Blocking the domain at network perimeter, updating URL filtering lists, and adding the domain to internal watchlists are recommended.