net-coinbase-us[.]framer[.]ai

This domain presents a direct threat to users by impersonating Coinbase, a major cryptocurrency exchange platform. The site mimics the official Coinbase sign-in page, tricking visitors into entering their account credentials, which are then captured by malicious actors. Such credential harvesting can lead to unauthorized access, financial theft, and further exploitation of compromised accounts. The page title, 'Coinbase Signin | Access Your Coinbase Account Safely,' is crafted to appear legitimate and lower user suspicion during interaction. Analysis indicates the domain was registered on January 06, 2018, through CSC Corporate Domains, Inc., a registrar commonly used for both legitimate and fraudulent purposes. The domain is flagged by 17 out of 95 security vendors on VirusTotal, reflecting a consensus among multiple detection engines regarding its malicious nature. Additionally, the site was hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) and resolved to the IP address 35.71.142.77, a common pattern observed in phishing campaigns leveraging cloud services for rapid deployment and takedown evasion. If you visited net-coinbase-us.framer.ai and entered login credentials, immediate action is required. First, change your Coinbase password using the official website or application from a secure device. Enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions or suspicious activity, and report any anomalies to the platform’s support team. Avoid clicking on links from unsolicited emails or messages, and verify the authenticity of any login page by checking the URL and SSL certificate issuer. Let’s Encrypt certificates, while valid, are frequently used in phishing sites due to their free and automated issuance process.