web-coinbase-com-auth[.]pineapple[.]page

The domain web-coinbase-com-auth.pineapple.page was observed serving a page with the title “Sign In | Coinbase.com Help”, a clear indication that the site attempts to impersonate the Coinbase brand. Infrastructure analysis shows the domain resolves to IP address 216.150.16.65, which is hosted in the United States and belongs to ASN16509, Amazon.com, Inc. The hosting environment is identified as Vercel, confirmed by the presence of Vercel DNS records (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology. The site employed HTTPS with a Let’s Encrypt R13 certificate and advertised HTTP Strict Transport Security (HSTS), suggesting an attempt to convey legitimacy. Registration details reveal the domain was purchased through Squarespace Domains II LLC, a common registrar for disposable or quickly provisioned domains.

The HTTP response code was 200, indicating the page was reachable when active. VirusTotal reported that 15 of 95 scanning engines flagged the domain, and the site appears on a single external blocklist and is explicitly blocked by PhishDestroy. The Gridinsoft trust score of 0 / 100 further underscores its malicious nature. The scam type is classified as a Crypto Scam, targeting users of the Coinbase platform.

The domain is currently offline, but the observed infrastructure components—Amazon‑owned IP, Vercel hosting, and a Let’s Encrypt certificate—remain reusable for future impersonation campaigns. Defenders should immediately block the domain and its associated IP address at network perimeter devices, add the domain to internal blacklist feeds, and monitor for any re‑registration attempts. Continuous observation of the ASN16509 address space for similar Vercel‑hosted domains is advisable, as attackers often reuse cloud resources to evade detection. Until further forensic evidence is collected, the observed indicators alone justify elevated risk handling and proactive mitigation.