secure-coinbase[.]framer[.]media

This domain is flagged as an elevated-risk brand impersonation site specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with legitimate Coinbase services, likely for credential theft or unauthorized transaction initiation. The threat type aligns with known patterns of cryptocurrency-related fraud, where attackers exploit brand trust to compromise user accounts or wallets. Infrastructure analysis reveals the domain secure-coinbase.framer.media was registered on November 19, 2021, through CSC Corporate Domains, Inc. It currently resolves to IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain is detected by 12 out of 95 security vendors on VirusTotal, with one active security blocklist entry. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Despite the current offline status and generic 'Site Not Found | Framer' page title, historical records confirm its use in brand impersonation campaigns. Mitigation steps for this threat type include immediate domain takedown requests to the registrar and hosting provider, alongside blacklisting the IP address and associated SSL certificate. Organizations should update detection rules to flag domains combining 'coinbase' with unrelated hosting platforms like Framer. Users should be educated to verify domain authenticity before entering credentials, particularly for cryptocurrency services. Security teams are advised to monitor for similar patterns, such as newly registered domains mimicking Coinbase on third-party platforms, and implement strict access controls for cryptocurrency-related accounts.