my-bassepre-view[.]pineapple[.]page

The domain my-bassepre-view.pineapple.page was observed serving a page titled "Coinbase - Buy and Sell Bitcoin(Coinbase - Sign In)" and is classified as a wallet/seed phishing site that impersonates Coinbase. Technical probes show the site returned HTTP 200 before being taken offline, hosted on Vercel infrastructure and protected by an active HSTS header. The SSL certificate is issued by Let’s Encrypt (R13) and the site resolves to IP 216.150.1.1, an Amazon.com, Inc. address (AS16509) located in the United States. Reputation data indicate a Gridinsoft trust score of 0 / 100 and the domain is listed on one security blocklist.

Google Safe Browsing flags the site for social engineering, and fifteen of ninety‑five VirusTotal scanners flagged it as malicious. The registrar is Vercel Inc., but no nameserver records were returned. The domain has been blocked by PhishDestroy and is currently offline. Evidence points to a targeted brand‑impersonation campaign aimed at extracting cryptocurrency wallet credentials from Coinbase users.

Uncertainties remain around the exact phishing kit used and any additional payloads that may have been delivered, as the page content has not been fully captured. Defenders should continue to block the domain and its associated IP, add the URL to local and cloud‑based blocklists, and monitor other Vercel‑hosted subdomains for similar page titles or SSL fingerprints. Network sensors should flag any outbound connections to the AS16509 prefix that coincide with attempts to contact Coinbase‑related endpoints, and incident response teams should advise users to verify the authenticity of any Coinbase login prompts received via email or browser redirects.