coibse-logn-feq[.]pineapple[.]page

This domain is flagged as an elevated-risk credential phishing site specifically targeting Coinbase users. Analysis indicates the infrastructure is designed to harvest login credentials for cryptocurrency wallets, with the page title explicitly mimicking the legitimate Coinbase login portal: 'Coinbase Login – Access Your Crypto Wallet Securely.' The threat type is confirmed as brand impersonation with a focus on financial account compromise, presenting immediate risks to user data and asset security. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain coibse-logn-feq.pineapple.page is registered through Vercel Inc. and resolves to IP address 216.150.16.193, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Detection metrics show 12 out of 95 security vendors on VirusTotal flagging this domain as malicious, while it appears on one security blocklist and is specifically blocked by PhishDestroy. The domain's creation date aligns with recent phishing campaign patterns, suggesting timely deployment for maximum impact. Mitigation requires immediate action from both security teams and potential victims. Network administrators should block the domain and its resolving IP (216.150.16.193) at firewall and DNS levels, while monitoring for related subdomains or IP associations. Users who may have interacted with this site should immediately reset their Coinbase credentials through the official platform, enable multi-factor authentication, and review account activity for unauthorized transactions. Security teams should analyze the domain's SSL certificate fingerprint and HTTP headers for additional indicators of compromise, while sharing threat intelligence with relevant cryptocurrency security communities to prevent further exploitation.