wallecoiprebese-cdq[.]pineapple[.]page

This domain, wallecoiprebese-cdq.pineapple.page, is flagged as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates it operates as a credential harvesting site, presenting a fraudulent login interface titled 'Coinbase.com Sign In | Secure Login to Your Crypto Wallet' to deceive victims into submitting sensitive account details. The infrastructure is designed to closely replicate the legitimate Coinbase authentication flow, increasing the likelihood of successful phishing attempts against cryptocurrency holders. Technical indicators confirm the malicious nature of this domain. It is detected by 15 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. The domain resolves to IP address 216.150.1.129, hosted on Amazon.com, Inc. (AS16509) infrastructure, and was registered through Vercel Inc. It appears on one security blocklist and was previously blocked by automated phishing detection systems. The SSL certificate is issued by Let's Encrypt (R13), a common tactic used to lend false legitimacy to phishing pages. As of the latest verification, wallecoiprebese-cdq.pineapple.page has been taken offline, reducing immediate exposure to users. However, the underlying infrastructure remains a residual risk, as threat actors may re-deploy similar domains or reuse the hosting environment for future campaigns. Users who interacted with this domain should immediately reset their Coinbase credentials and enable multi-factor authentication. Organizations should monitor for related indicators, including the IP address and SSL certificate issuer, to detect potential follow-up attacks.