register-coinbse-web[.]framer[.]media

The domain register-coinbse-web.framer.media is identified as a high-risk brand impersonation threat targeting Coinbase. The domain impersonates the Coinbase brand, specifically mimicking the Coinbase Pro login page, to deceive users and potentially steal their credentials. Infrastructure analysis reveals that this domain does not use any specific crypto drainer kits, but its design and content are tailored to mimic the authentic Coinbase environment, making it a significant risk for users.

Technical indicators for the domain include a VirusTotal score of 17/95, indicating that 17 out of 95 security vendors flagged this domain as malicious. The domain is registered through CSC Corporate Domains, Inc., and resolves to the IP address 52.223.52.2, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The domain was created on November 19, 2021, and appears on three security blocklists. Additionally, it is blocked by PhishDestroy, MetaMask, and SEAL, further confirming its malicious nature.

The domain is currently offline, which mitigates the immediate risk to users. However, the domain's past online presence and its appearance on multiple blocklists indicate a history of malicious activity. It is recommended that all users who may have interacted with this domain change their Coinbase passwords and monitor their accounts for any unauthorized activity. Security teams should continue to monitor the domain for any signs of reactivation and consider adding it to their blocklists to prevent future incidents.