coinbase-supportcenter-247-assistance[.]lovable[.]app

The domain coinbase-supportcenter-247-assistance.lovable.app was registered on May 06, 2023 through Cloudflare, Inc. DNS resolution points to IP address 185.158.133.1, which belongs to Cloudflare’s AS13335 infrastructure and is geolocated in Poland. The site serves an HTTPS endpoint signed by Google Trust Services under the WE1 intermediate, indicating a valid certificate chain but offering no guarantee of legitimacy. An HTTP request to the domain returns a 302 redirect, a common technique for steering victims to a malicious landing page. Header analysis shows the presence of HSTS and Cloudflare‑managed services, and the authoritative nameservers are ivan.ns.cloudflare.com and rafe.ns.cloudflare.com. The page title exposed by the server is "Coinbase Customer Support 24/7 - Get Help Now", explicitly targeting Coinbase users.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on one external blocklist, having been actively blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑hundred trust rating, reflecting extreme risk. VirusTotal reports that 15 of 93 antivirus and URL scanners flag the domain as malicious, reinforcing the suspicion. The listed scam type is a crypto scam, suggesting the site may attempt to harvest credentials or lure victims into financial loss.

While the exact payload or credential‑capture mechanisms have not been publicly disclosed, the convergence of redirection, brand impersonation, low trust score, and multiple vendor detections indicates a high‑confidence malicious operation. Defenders should add the domain and its hosting IP to blocklists, enforce DNS filtering for the .lovable.app TLD, and monitor outbound traffic to Cloudflare edge nodes originating from Poland. User‑facing security awareness programs should highlight the forged support‑center phrasing and advise that legitimate Coinbase support never uses such URLs.