coinbase-expect[.]framer[.]ai

This domain, coinbase-expect.framer.ai, is identified as a high-risk credential phishing site specifically targeting Coinbase users. Analysis indicates the domain impersonates the official Coinbase login interface, presenting a page titled 'Sign In | Coinbase' to deceive victims into submitting account credentials. The infrastructure lacks association with any known drainer kits but exhibits clear indicators of brand impersonation designed to harvest sensitive financial login details. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and currently resolves to IP address 35.71.142.77, hosted on Amazon.com, Inc. (AS16509). Security vendor detections on VirusTotal report 15 out of 95 engines flagging the domain as malicious. Google Safe Browsing explicitly classifies it as a phishing site, and it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, with serial number E8, which while valid, is commonly exploited in phishing campaigns due to its low-cost and automated issuance. As of the latest assessment, coinbase-expect.framer.ai has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Response actions include blocking by security vendors and removal from active service, but residual risk persists due to the domain's age, registration history, and prior abuse. Organizations are advised to monitor for re-emergence, enforce DNS-level blocking, and educate users on recognizing impersonation attempts targeting financial platforms.