web-coinbase-comm[.]pineapple[.]page

The domain web-coinbase-comm.pineapple.page is assessed as a high-risk brand impersonation threat targeting Coinbase. This domain poses a significant risk to users who may be tricked into believing it is a legitimate Coinbase site, potentially leading to credential theft or financial loss.

Analysis indicates that the domain web-coinbase-comm.pineapple.page resolves to the IP address 216.150.16.65, which is located in the United States and is part of the Amazon.com, Inc. (AS16509) network. The domain is registered through Squarespace Domains II LLC. It has been flagged by Google Safe Browsing as a phishing site and appears on one known security blocklist. Additionally, VirusTotal reports that 15 out of 95 security vendors flag this domain as malicious. The SSL certificate is issued by Let's Encrypt / R13, which is a common certificate authority used by legitimate and malicious sites alike. The domain has been taken offline, but it remains important to be vigilant as similar threats can re-emerge with different domain names.

To mitigate the risk of brand impersonation and credential theft, users are advised to verify the URL of any Coinbase-related site before entering sensitive information. Users should only access Coinbase through official channels and bookmarks, and avoid clicking on links from unsolicited emails or messages. Network administrators should consider implementing domain-based message authentication, reporting, and conformance (DMARC) policies to prevent phishing emails from reaching users. Additionally, using multi-factor authentication (MFA) for Coinbase accounts can significantly reduce the impact of credential theft.