get-coinbase-com[.]framer[.]ai

This domain, get-coinbase-com.framer.ai, is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. The site presents itself as a Coinbase Wallet Extension setup page, likely designed to harvest credentials or distribute malicious payloads under the guise of legitimate wallet installation. No direct evidence of a drainer kit is present, but the page title 'Coinbase Wallet Extension — Getting Started' strongly suggests an intent to deceive users into entering sensitive authentication details. Analysis indicates the domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. It appears on two security blocklists and is also blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing minimal assurance of authenticity. As of the latest assessment, get-coinbase-com.framer.ai has been taken offline, reducing immediate exposure to users. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Organizations and individuals are advised to monitor for renewed activity, update blocklists, and conduct retrospective log analysis to identify any prior interactions with this domain. Users who accessed the site should assume credential compromise and initiate password resets, enable multi-factor authentication, and review connected accounts for unauthorized activity.