coin-base[.]framer[.]ai

This domain, coin-base.framer.ai, is identified as a brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain hosts a fraudulent login page titled 'Sign In,' designed to harvest user credentials under the guise of the legitimate Coinbase interface. No direct evidence of a crypto drainer kit was observed, but the credential harvesting capability alone poses significant risk to affected users, particularly those unaware of the impersonation tactic.

Technical indicators reveal the domain was registered on January 06, 2018, through CSC Corporate Domains, Inc., and currently resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). VirusTotal detection metrics show 9 out of 95 security vendors flagging the domain as malicious. The domain appears on a single security blocklist and uses a Let's Encrypt SSL certificate (serial number prefix E8). Google Safe Browsing (GSB) status is not explicitly listed, but the domain's presence on one blocklist and offline status suggest prior detection and mitigation efforts.

As of the latest assessment, coin-base.framer.ai has been taken offline, reducing immediate exposure risk. However, the domain's historical activity and registration details remain a concern, particularly if the infrastructure is repurposed or re-activated. Users who may have interacted with the domain are advised to reset credentials immediately, enable multi-factor authentication (MFA) on all financial and cryptocurrency accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and conduct retrospective log analysis to identify potential prior interactions.