coin-mobile-mimic[.]lovable[.]app

This domain, coin-mobile-mimic.lovable.app, is identified as a high-risk phishing site specializing in brand impersonation. Analysis confirms it mimics Coinbase, a major cryptocurrency exchange platform, with the explicit intent to harvest user credentials and sensitive financial information. The page title, coin-mobile-mimic, suggests a mobile-centric attack vector, likely targeting users accessing the platform via smartphones or tablets. No explicit drainer kit signatures were observed in available telemetry, though the infrastructure aligns with credential theft campaigns observed in recent months. Infrastructure analysis reveals multiple technical indicators corroborating malicious intent. The domain resolves to the IP address 185.158.133.1, hosted on AS13335 (Cloudflare, Inc.) with a geolocation in Poland. It was registered on May 06, 2023, through Cloudflare, Inc., a registrar frequently leveraged by threat actors for its privacy protections and rapid deployment capabilities. Detection metrics include a VirusTotal score of 12/95 security vendors flagging the domain, while Google Safe Browsing explicitly designates it as a phishing threat. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), does not mitigate its malicious classification. As of the latest assessment, coin-mobile-mimic.lovable.app has been taken offline, likely in response to detection and reporting by security entities. Despite its inactive status, residual risk persists due to potential cached DNS entries, delayed blocklist propagation, or re-emergence under altered infrastructure. Users who accessed the domain prior to takedown are advised to immediately revoke any entered credentials, enable multi-factor authentication on associated accounts, and monitor for unauthorized transactions. Organizations should update internal blocklists to include this domain and its resolving IP to prevent future access attempts.