chat-coinbase-supl[.]lovable[.]app

The domain chat-coinbase-supl.lovable.app is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis confirms its status as offline, though it previously operated as a fraudulent support portal designed to harvest login credentials and sensitive financial information. The page title, 'Contact Support | Coinbase Help Center,' explicitly mimics legitimate Coinbase infrastructure to deceive victims. Infrastructure analysis reveals the domain was registered through CloudFlare, Inc., and resolved to the IP address 185.41.148.1, located in Sweden. Security telemetry indicates detection by 11 of 95 vendors on VirusTotal, with Google Safe Browsing flagging it as phishing. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Its SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate while concealing malicious intent. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this campaign, particularly targeting cryptocurrency accounts. Network administrators should update blocklists to include the domain and associated IP (185.41.148.1) to prevent future exposure. Users are urged to verify support portals exclusively through official channels and enable multi-factor authentication to mitigate credential theft risks.