coinbase-com-sing[.]framer[.]ai

This domain, coinbase-com-sing.framer.ai, presents a high-risk brand impersonation threat by mimicking the official Coinbase login portal. Analysis of the page title, 'Can't sign in to your account - Coinbase Help,' confirms the intent to deceive users into submitting sensitive credentials, such as usernames, passwords, and two-factor authentication codes. The fraudulent page is designed to closely resemble legitimate Coinbase support pages, increasing the likelihood of successful credential harvesting before victims recognize the deception. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is flagged by 18 out of 95 security vendors on VirusTotal, with two additional security blocklists, PhishDestroy and PhishingDB, listing it as a confirmed phishing resource. Registered through CSC Corporate Domains, Inc. on January 6, 2018, the domain resolves to the IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509). Google Safe Browsing has also classified this domain as phishing, and the SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. Users who visited coinbase-com-sing.framer.ai should take immediate action to mitigate potential compromise. Credentials entered on this domain should be considered exposed and must be changed without delay, starting with the primary email account and followed by all financial or cryptocurrency-related platforms. Enable multi-factor authentication on all critical accounts if not already active. Monitor linked accounts for unauthorized transactions or login attempts, and report any suspicious activity to the affected service providers. If personal or financial data was submitted, consider placing a fraud alert on credit files to prevent identity misuse.