coinbs-sign-web[.]framer[.]ai

PhishDestroy identifies coinbs-sign-web.framer.ai as a high-risk threat due to confirmed brand impersonation targeting Coinbase. This domain was specifically designed to deceive users into believing they are accessing legitimate Coinbase support or account recovery pages, a classic phishing tactic that often leads to credential theft. The site is now offline, but its historical activity remains a serious concern for anyone who may have encountered it.

Technical analysis reveals alarming indicators. VirusTotal shows that 13 out of 95 security vendors flagged this domain as malicious, with Google Safe Browsing specifically categorizing it as phishing. The domain was created on January 6, 2018, and is registered through CSC Corporate Domains, Inc., resolving to IP address 52.223.52.2. It appears on one security blocklist and uses an SSL certificate from Let's Encrypt (type E8), which is commonly abused by phishers to create a false sense of security. The page title was "sign in to your account - Coinbase Help*," a clear attempt to mimic Coinbase's official help portal.

To protect against such threats, users should always verify URLs before entering credentials, especially for cryptocurrency platforms. Never click on links from unsolicited emails or messages; manually type the official domain (e.g., coinbase.com) into your browser. Enable two-factor authentication on all accounts and use a password manager to avoid reusing passwords. If you have interacted with this site, change your Coinbase password immediately and contact Coinbase support. Report any similar domains to anti-phishing organizations to help takedown efforts.