public-cnbase-nav[.]framer[.]ai

This domain, public-cnbase-nav.framer.ai, hosts a fraudulent cryptocurrency login page. The page title, "Log In | Coinbase pro login®: | Sign In to Your Account - Log In@", explicitly impersonates the Coinbase brand. The threat is credential theft, as the site is designed to trick users into entering their Coinbase account credentials, which attackers could then use to access and drain legitimate cryptocurrency wallets.

Technical evidence shows the site was flagged by 12 out of 95 VirusTotal vendors. It was detected by ChainPatrol, alphaMountain.ai, CyRadar, Ermes, and ESET. The domain is registered with CSC Corporate Domains, Inc., and was created on 2018-01-06. The IP address 35.71.142.77 is located in the United States and belongs to AS16509 Amazon.com, Inc. The SSL certificate is issued by Let's Encrypt (E8). The nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

The site is currently offline or down. The risk level is high due to the specific impersonation of a major cryptocurrency platform and the confirmed detection by multiple security vendors. Users who may have visited this site when it was active should change their Coinbase credentials immediately and enable two-factor authentication.