coinbaase-login[.]framer[.]ai

The domain coinbaase-login.framer.ai has been identified as a brand impersonation phishing site specifically targeting Coinbase, a popular cryptocurrency platform. This domain is currently offline, having been taken down after security researchers and threat intelligence systems flagged it as malicious. The site was designed to deceive users into believing they were accessing the legitimate Coinbase login portal, with a page title reading 'Coinbase Login | Secure Access to Your Crypto Portfolio' to lend an air of authenticity.

Technical analysis reveals that the domain was flagged by 16 out of 95 security vendors on VirusTotal, a significant indicator of malicious intent. The domain was registered through CSC Corporate Domains, Inc. and was created on January 06, 2018, suggesting it may have been repurposed for phishing after being dormant. It resolves to IP address 52.223.52.2 and appears on 2 security blocklists. The SSL certificate was issued by Let's Encrypt (E8), which is common among legitimate sites but is also frequently abused by phishers. Google Safe Browsing has flagged the domain for phishing, providing an additional layer of confirmation.

Given that the site is now offline, immediate risk to users is low, but vigilance is still advised. Users should always double-check URLs before entering credentials, especially for financial services like Coinbase. The legitimate Coinbase domain is coinbase.com, and any variation—such as 'coinbaase-login.framer.ai'—should be treated as suspicious. PhishDestroy recommends using password managers and enabling two-factor authentication to reduce the impact of credential theft. If you have already entered information on this site, change your Coinbase password immediately and contact Coinbase support for further assistance.