supports-logi-base[.]framer[.]media

The domain supports-logi-base.framer.media is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms the domain is designed to deceive users into submitting login credentials by replicating the official Coinbase sign-in interface, as evidenced by the page title "Sign In | Coinbase.com - coinaseweb." The domain is currently offline, but prior activity indicates malicious intent. Technical indicators reveal the domain was registered on November 19, 2021, through CSC Corporate Domains, Inc. It resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain appears on three security blocklists and is flagged by 18 of 95 VirusTotal security vendors. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Detection engines such as PhishDestroy, MetaMask, and SEAL have explicitly blocked this domain due to its association with brand impersonation and credential theft. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and registration details suggest potential for re-emergence under a similar or altered domain. Organizations and individuals are advised to block the domain and its associated IP (52.223.52.2) at the network level. Users who may have interacted with this domain should immediately reset credentials for Coinbase and any other accounts where identical passwords were reused. Monitoring for unauthorized transactions or login attempts is strongly recommended. Security teams should treat any future domains with similar naming patterns or hosting infrastructure as high-risk.