being-coiis-app-en[.]pineapple[.]page

This domain, being-coiis-app-en.pineapple.page, was identified as a brand impersonation phishing site targeting Coinbase. The investigation, completed on July 23, 2026, found the domain offline at the time of reporting. The page title, 'Coinbase Pro Login – Trade Crypto with Confidence', directly indicates an attempt to collect login credentials from Coinbase users. The domain resolved to IP address 216.150.1.193, hosted in the United States on Amazon Web Services (AS16509 Amazon.com, Inc.). It was registered through Vercel Inc. and utilized a Let's Encrypt SSL certificate (R13).

VirusTotal flagged the domain with 12 out of 95 security vendors marking it as malicious. The Gridinsoft trust score was 0 out of 100, and the domain appeared on one security blocklist, including PhishDestroy. The HTTP status returned a 200 code, indicating the page was accessible before being taken offline. The domain employed Vercel and HSTS technologies.

Notably, nameservers were not found (NS_NOT_FOUND), suggesting the domain may have been redirected or its DNS configuration was incomplete at the time of analysis. Defenders should verify that any credentials potentially submitted to this domain are immediately rotated and monitor for associated phishing campaigns using similar subdomain patterns or hosting providers. Given the low trust score and high vendor detection, this domain represents a clear threat to Coinbase users and should remain blocked. No additional infrastructure details, such as associated IP ranges or related domains, were confirmed in this investigation.