secure-coinbase[.]framer[.]ai

The domain secure-coinbase.framer.ai is assessed at an elevated risk level for brand impersonation, specifically targeting the cryptocurrency exchange Coinbase. This type of threat often aims to deceive users into providing sensitive information, such as login credentials or personal data, under the pretense of being a legitimate Coinbase service.

Infrastructure analysis reveals that the domain was registered through CSC Corporate Domains, Inc., and resolves to an IP address in the United States (AS16509 Amazon.com, Inc.). The IP address is 35.71.142.77. The domain was created on January 06, 2018, and has been flagged by 18 out of 95 security vendors on VirusTotal. It is also listed on two security blocklists, PhishDestroy and PhishingDB, indicating past malicious activity. The SSL certificate is issued by Let's Encrypt, which is a common practice for legitimate sites but does not necessarily guarantee security. The page title found, 'Log In | Coinbase pro login®: | Sign In to Your Account - Log In@', closely mimics the official Coinbase login page, further suggesting an attempt to impersonate the brand.

To mitigate the risk of brand impersonation, users should verify the domain and URL of any website before entering sensitive information. It is recommended to access Coinbase only through official channels, such as the verified website or mobile app, and to avoid links sent via unsolicited emails or messages. Security teams and network administrators should consider blocking this domain and similar variants to prevent potential credential theft and protect users from falling victim to this impersonation scam.