com-sign-in-coinbase[.]pineapple[.]page

This domain, com-sign-in-coinbase.pineapple.page, was identified as a brand impersonation threat targeting Coinbase, specifically mimicking the Coinbase Pro login interface as indicated by the page title 'Coinbase Pro Login | Secure Access to Your Account.' Infrastructure analysis reveals the domain was hosted on Amazon.com, Inc. (AS16509) with an IP address of 216.150.1.193, located in the US. The domain was registered through Squarespace Domains II LLC and utilized nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, with Vercel and HSTS technologies detected. The SSL certificate was issued by Let's Encrypt (R13), and the domain returned an HTTP 200 status prior to being taken offline. At the time of assessment, 11 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist, including PhishDestroy.

Gridinsoft assigned a trust score of 0/100, further indicating its high-risk nature. The domain is currently offline, but defenders should treat any residual or future resolution attempts as suspicious. Given the explicit targeting of Coinbase users and the use of a login-themed page title, this infrastructure was likely intended for credential harvesting or cryptocurrency theft. No evidence of a phishing kit or additional payloads was provided, so the exact attack mechanics remain unconfirmed.

Defenders are advised to block the domain and its resolving IP at the network level, monitor for related subdomains or typosquatting variants, and alert users to potential Coinbase-themed phishing attempts. If logs indicate prior access, initiate credential reset protocols for affected accounts. The domain's registration and hosting details should be preserved for further investigation or takedown coordination.