coinbasecdp-en-us[.]framer[.]ai

This report details a malicious domain, coinbasecdp-en-us.framer.ai, which is designed to impersonate the legitimate cryptocurrency exchange Coinbase. The site's page title, "Coinbase - Buy and Sell Bitcoin, Ethereum, and more …", is consistent with a phishing or credential harvesting operation targeting users seeking to access Coinbase services. The threat posed is financial fraud, as visitors may be tricked into entering login credentials or private keys on a fraudulent platform.

Technical analysis confirms the site's malicious nature. VirusTotal data indicates the domain was flagged by 10 out of 95 vendors, with detections from ADMINUSLabs, ChainPatrol, alphaMountain.ai, CyRadar, and ESET. The domain is listed on 1 blocklist. It is registered with CSC Corporate Domains, Inc., and was created on 2018-01-06. The IP address is 35.71.142.77, hosted in the United States under AS16509 (Amazon.com, Inc.). The domain uses a Let's Encrypt SSL certificate (E8) and its nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

The domain is currently offline, reducing immediate risk of active exploitation. However, the site poses a high risk to users due to its specific impersonation of a major cryptocurrency brand and confirmed detection by multiple security vendors. The domain remains registered and could be reactivated, warranting continued monitoring.