coinbase-procom[.]framer[.]ai

The site at coinbase-procom.framer.ai is a fraudulent cryptocurrency platform impersonating the legitimate Coinbase brand. Its page title, "Sign In | Coinbase** Pro*", is designed to trick users into believing they are accessing a genuine Coinbase Pro login page. This site poses a credential theft threat, as it likely captures login credentials and potentially two-factor authentication codes from victims.

Technical evidence confirms the malicious nature of this domain. VirusTotal reports 9 out of 95 security vendors flagged the site as malicious. Google Safe Browsing has flagged it for SOCIAL_ENGINEERING. The domain is registered through CSC Corporate Domains, Inc., and hosted on IP address 35.71.142.77, which belongs to AS16509 Amazon.com, Inc. in the United States. The domain was created on January 6, 2018, and uses an SSL certificate issued by Let's Encrypt (serial E8). Its nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

The site is currently offline and flagged by multiple threat intelligence sources including ChainPatrol, alphaMountain.ai, CRDF, CyRadar, and Fortinet. The risk level is high due to its impersonation of a well-known financial service and its active detection by security vendors. Users who may have visited the site should assume their credentials are compromised and take immediate protective actions.