secure-coinbase-sign[.]framer[.]ai

The domain secure-coinbase-sign.framer.ai has been identified as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms this domain was designed for credential theft, presenting users with a fraudulent login interface mimicking the legitimate Coinbase.com portal. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was flagged by 10 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered through CSC Corporate Domains, Inc. and resolved to the IP address 52.223.52.2. The domain was created on February 21, 2026, and appeared on three distinct security blocklists. The SSL certificate was issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious domains due to its accessibility. The page title, 'Coinbase.com Login – Secure Access to Your Crypto Account,' was crafted to deceive users into entering sensitive credentials. Current status confirms the domain is offline, reducing immediate risk of active exploitation. However, organizations and individuals should remain vigilant. It is recommended to block the domain and associated IP (52.223.52.2) at the network level, revoke any sessions initiated through this domain, and conduct password resets for accounts potentially exposed. Security teams should monitor for indicators of compromise, including the domain name, SSL certificate fingerprint, and resolved IP, to prevent future incidents involving similar infrastructure.