coinbase-sso-eng-auth[.]pineapple[.]page

This domain, coinbase-sso-eng-auth.pineapple.page, is flagged for brand impersonation targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain mimics a single sign-on (SSO) authentication portal, likely designed to harvest user credentials or facilitate unauthorized account access. No direct evidence of a crypto drainer kit was observed, but the SSO impersonation aligns with credential theft tactics commonly used in financial fraud campaigns. Infrastructure analysis reveals the domain was registered on September 21, 2022, through Squarespace Domains II LLC and resolves to the IP address 216.150.1.129, hosted on Amazon.com, Inc. infrastructure (AS16509). VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain employs a Let's Encrypt SSL certificate (R13), which, while providing encryption, does not validate legitimacy. Google Safe Browsing (GSB) does not currently list the domain, but its offline status suggests takedown actions may have been initiated. As of the latest assessment, coinbase-sso-eng-auth.pineapple.page is offline, reducing immediate risk to end users. However, the domain's infrastructure remains registered, and the SSL certificate could be reused or repurposed for future malicious activity. Organizations are advised to monitor for residual DNS resolution attempts or certificate reuse tied to this domain. Users who may have interacted with the domain should reset credentials for Coinbase and any associated accounts, enable multi-factor authentication, and review transaction logs for unauthorized activity. Proactive blocking of the domain and its resolved IP (216.150.1.129) is recommended for network-level defenses.