nav--sso--coinbasepro--cdn[.]framer[.]ai

The domain nav--sso--coinbasepro--cdn.framer.ai is assessed as posing an elevated risk of brand impersonation, specifically targeting Coinbase. The impersonation is intended to deceive users into believing they are interacting with the legitimate Coinbase Pro digital asset exchange.

Infrastructure analysis reveals that the domain resolves to the IP address 35.71.142.77, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The domain was created on January 06, 2018, and is registered through CSC Corporate Domains, Inc. Security vendors on VirusTotal have flagged this domain, with 18 out of 95 vendors identifying it as malicious. The domain appears on two security blocklists, PhishDestroy and PhishingDB, further indicating its potential for misuse. The SSL certificate is issued by Let's Encrypt, which is a common choice for both legitimate and malicious sites. The page title, 'Official Site | Coinbase Pro | Digital Asset Exchange®,' is a clear attempt to mimic the official Coinbase Pro website.

To mitigate the risks associated with brand impersonation, it is recommended that Coinbase and its users take several steps. Coinbase should monitor for and report any similar domain registrations to the appropriate authorities and domain registrars. Users should be educated to verify the URL and SSL certificate of the website they are accessing, and to use only official communication channels provided by Coinbase. Additionally, implementing domain monitoring and takedown services can help prevent the registration and operation of such malicious domains in the future.