Scanner detected a domain impersonating Coinbase with the brand appearing in the domain name and page content. The site uses a SPA architecture with dynamic credential capture scripts loaded from the same domain, and includes a new SSL certificate and Cloudflare infrastructure, typical of phishing setups designed to evade rudimentary checks. The combination of a visually legitimate Sign in page, brand-name domain, and evidence of credential collection scripts strongly indicates credential phishing. Immediate action recommended: suspend_domain and block_url to mitigate risk to users and prevent credential theft.