coins-cdn-pro-eng[.]framer[.]media

The domain coins-cdn-pro-eng.framer.media has been identified as a threat engaging in brand impersonation targeting Coinbase. The domain impersonates the Coinbase brand and uses the page title 'Coinbase Pro Login – Advanced Crypto Trading' to deceive users into believing it is an official Coinbase site. This can lead to credential theft and financial loss.

Analysis indicates that the domain has been flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus on its malicious nature. The domain was registered through CSC Corporate Domains, Inc., and resolves to the IP address 35.71.142.77, which is located in the US and is part of the AS16509 Amazon.com, Inc. network. The domain was created on November 19, 2021. Google Safe Browsing has flagged this domain as a phishing site, and it appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt, which is a common practice for phishing sites to gain user trust.

The current status of the domain is offline, indicating that it has been taken down or is no longer active. However, this does not eliminate the need for ongoing monitoring and proactive measures to prevent any residual or future threats. Organizations and individuals should ensure that any cached or stored links to this domain are removed and that users are educated about the risks of visiting such sites. Additionally, it is recommended to implement DNS-based blocking and to monitor for similar domain registrations or activity to mitigate the risk of further brand impersonation attempts.