portal-coin-pro-cdn[.]pineapple[.]page

This domain, portal-coin-pro-cdn.pineapple.page, is flagged as a brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure was designed to mimic the Coinbase Pro login interface, as evidenced by the page title 'Coinbase Pro Login | Secure Access to Your Account.' The threat type aligns with credential theft, where attackers harvest login credentials to gain unauthorized access to cryptocurrency accounts. No direct evidence of a crypto drainer kit was observed, but the domain's design suggests a focus on immediate credential capture rather than automated fund exfiltration. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC and currently resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc. (AS16509). The domain is flagged by 12 out of 95 security vendors on VirusTotal, with a single blocklist (PhishDestroy) listing it for malicious activity. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as it is commonly used by both legitimate and malicious actors. No Google Safe Browsing (GSB) status is available, but the domain's presence on a security blocklist and its VirusTotal score confirm its malicious classification. Creation date data is unavailable, but the domain's recent takedown suggests it was operational for a limited period. The domain is currently offline, reducing immediate risk to users. However, residual threats remain, as attackers may repurpose the infrastructure or deploy similar domains to continue their campaign. Users who interacted with this domain should assume credential compromise and take immediate action, including password resets and multi-factor authentication (MFA) review on their Coinbase accounts. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-up attacks. The elevated risk level is justified by the domain's direct targeting of a major cryptocurrency exchange and its prior operational status, which could have enabled significant credential theft.