coinbase-learn[.]framer[.]media

This domain, coinbase-learn.framer.media, poses a significant threat as a brand impersonation site designed to mimic Coinbase, a well-known cryptocurrency exchange platform. The site presents a fraudulent login page titled 'Coinbase - Sign in,' aiming to deceive users into entering their account credentials. Once entered, these credentials are harvested by threat actors, potentially leading to unauthorized access to victims' cryptocurrency wallets and financial loss. The site’s design and structure closely resemble the legitimate Coinbase platform, increasing the likelihood of successful deception, particularly among users unfamiliar with phishing tactics. Analysis indicates that coinbase-learn.framer.media was registered on November 19, 2021, through CSC Corporate Domains, Inc. The domain is flagged by 22 out of 95 security vendors on VirusTotal, reflecting widespread detection as malicious. It resolves to the IP address 52.223.52.2, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is classified as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as encrypted phishing sites are a common tactic to appear legitimate. Users who have visited coinbase-learn.framer.media or entered credentials on the site should take immediate action to secure their accounts. First, change the password for the affected Coinbase account and enable multi-factor authentication if not already active. Monitor the account for any unauthorized transactions or suspicious activity. If financial loss is suspected, report the incident to the relevant financial institution and local cybercrime authorities. Additionally, scan the device used to access the site for malware, as phishing pages may distribute malicious payloads. Avoid interacting with any communications claiming to be from Coinbase that reference this domain, as they may be part of a follow-up phishing attempt.