portal-coin-base-eng[.]framer[.]ai

This report details a fraudulent website designed to impersonate the Coinbase cryptocurrency exchange. The site's page title, "Coinbase Pro Login® | Secure™ Access Assets," indicates it was configured to present itself as a legitimate login portal for Coinbase Pro. The threat posed is credential theft and cryptocurrency asset compromise, as victims would be tricked into entering their login credentials on this fraudulent page, allowing attackers to drain their accounts.

Technical analysis confirms the malicious nature of this site. VirusTotal flagged it with 12 detections out of 95 security vendors. The domain, portal-coin-base-eng.framer.ai, was created on 2018-01-06 and registered through CSC Corporate Domains, Inc. It resolves to IP address 52.223.52.2, hosted in the United States on AS16509 (Amazon.com, Inc.). The site uses an SSL certificate issued by Let's Encrypt (fingerprint E8) and is served via Amazon Web Services nameservers. It was flagged by multiple security vendors including ChainPatrol, alphaMountain.ai, Certego, CyRadar, and ESET, and appears on 1 blocklist.

The website is currently down or offline. The risk level is high for any user who may have visited the site while it was active, as credentials could have been compromised. Immediate steps for affected users include changing passwords and enabling two-factor authentication on their legitimate Coinbase accounts.