access-coinbase-pros[.]framer[.]ai

This domain, access-coinbase-pros.framer.ai, operates as a confirmed brand impersonation site designed to deceive users into believing they are interacting with Coinbase, a major cryptocurrency exchange. The site likely aims to harvest login credentials, enabling unauthorized access to victim accounts, or to facilitate cryptocurrency theft by tricking users into entering sensitive wallet or authentication details. The use of a subdomain on framer.ai suggests an attempt to exploit the legitimacy of the Framer platform to evade detection and lend false credibility to the malicious operation. Analysis indicates this domain is supported by substantial technical evidence of malicious activity. VirusTotal reports that 9 out of 95 security vendors have flagged the domain as malicious, while Google Safe Browsing has explicitly classified it as a phishing site. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, though its malicious use appears to be more recent. It currently appears on at least one security blocklist and resolves to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. The SSL certificate is issued by Let’s Encrypt, a common tactic used by threat actors to mimic secure connections and reduce user suspicion. Users who visited access-coinbase-pros.framer.ai should take immediate action to mitigate potential compromise. Those who entered credentials or financial information should assume their accounts are at risk and initiate password resets on the legitimate Coinbase platform using multi-factor authentication. All connected devices should be scanned for malware, and any suspicious transactions in linked wallets or bank accounts should be reported to the relevant financial institution. Browser data, including cookies and saved passwords, should be cleared to eliminate any residual session tokens. Monitoring for unauthorized access or unusual activity is strongly advised for at least 30 days following exposure.