eng-coinbasepro-learn[.]pineapple[.]page

This domain, eng-coinbasepro-learn.pineapple.page, poses a high-risk brand impersonation threat targeting cryptocurrency users through a fraudulent Coinbase Pro login portal. Analysis indicates the site was designed to mimic the legitimate Coinbase Pro authentication interface, using the page title 'Coinbase Pro Login | Secure® Your Crypto Account' to deceive visitors into entering sensitive credentials. Such fake login portals are commonly used to harvest usernames, passwords, and two-factor authentication codes, enabling unauthorized access to cryptocurrency accounts and subsequent asset theft. The domain infrastructure and content were engineered to exploit trust in the Coinbase brand, increasing the likelihood of successful credential compromise for users unfamiliar with official login procedures. Evidence supporting the malicious classification includes detection by 14 out of 95 security vendors on VirusTotal, with the domain explicitly flagged for phishing by Google Safe Browsing. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC and resolved to the IP address 216.150.16.129, hosted on Amazon.com, Inc. (AS16509) infrastructure. The SSL certificate was issued by Let's Encrypt (R13), a common tactic used by threat actors to lend superficial legitimacy to fraudulent sites. The domain appears on at least one security blocklist and was proactively blocked by anti-phishing systems prior to being taken offline. No legitimate creation date or historical context was provided, further indicating its transient and malicious nature. Users who visited eng-coinbasepro-learn.pineapple.page should assume their credentials may have been compromised and take immediate remediation steps. First, reset passwords for Coinbase and any other accounts where the same credentials were reused, prioritizing accounts with financial or cryptocurrency access. Enable multi-factor authentication using an authenticator app or hardware key, avoiding SMS-based methods due to susceptibility to interception. Monitor all linked accounts for unauthorized transactions, address changes, or API key modifications. If cryptocurrency assets were accessed or transferred after visiting the site, report the incident to the platform and relevant financial authorities. Additionally, scan local devices for malware using updated security tools, as fake login portals may deploy secondary payloads or keyloggers. Exercise heightened caution with unsolicited communications referencing Coinbase or cryptocurrency services, verifying sender authenticity through official channels before engaging.