coinbase-help-team[.]lovable[.]app

This domain, coinbase-help-team.lovable.app, is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure was designed to mimic legitimate Coinbase authentication portals, likely to harvest cryptocurrency wallet credentials or personal account details. The page title, 'Lovable App,' does not align with Coinbase’s official branding, further suggesting malicious intent. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 185.158.133.1, hosted on AS13335 (Cloudflare, Inc.) in Poland. At the time of detection, 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing classified it as phishing. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. The domain is currently offline, reducing immediate risk to users. However, the infrastructure may resurface under a different domain or IP address. Response actions should include monitoring for related domains registered through the same registrar or resolving to the same IP range. Users who accessed the domain are advised to rotate credentials, enable multi-factor authentication, and verify account activity for unauthorized transactions. Remaining risk includes potential reuse of the phishing kit or infrastructure for future campaigns.