manage-coinbasecom-help[.]framer[.]ai

This domain, manage-coinbasecom-help.framer.ai, is flagged as a brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site replicates the official Coinbase login interface, as evidenced by the page title 'Coinbase.com: Sign-in | Coinbase Login (Official Site)', to harvest user credentials. No drainer kit signatures were identified in initial scans, but the domain exhibits classic phishing infrastructure characteristics designed to deceive users into submitting sensitive authentication details. Infrastructure analysis reveals the domain was registered on January 06, 2018, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) infrastructure located in the US. The SSL certificate is issued by Let's Encrypt (serial number prefix E8). VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain has been taken offline, likely in response to detection and reporting. While the immediate threat is mitigated, residual risk remains due to potential credential reuse by victims who may have interacted with the site prior to takedown. Organizations are advised to monitor for authentication attempts using credentials associated with this campaign and implement multi-factor authentication (MFA) to mitigate credential-based attacks. Users should verify domain authenticity before entering login details and report suspicious domains to their security teams for further investigation.