en-us-ectn-coinase[.]framer[.]ai

The domain en-us-ectn-coinase.framer.ai was observed as a generic phishing infrastructure and is currently listed as offline. Registration data shows the domain was created on 06 January 2018 through CSC Corporate Domains, Inc., and the authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. DNS resolution points to the IPv4 address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The host presents an HTTPS service using a Let’s Encrypt certificate issued to “E8”, and the connection enforces HTTP Strict Transport Security and negotiates HTTP/3, indicating a modern web stack. Technology fingerprints identify Framer Sites and a React front‑end, consistent with the Framer platform hosting.

The only visible page returns HTTP status 404 with the title “Site Not Found | Framer”, confirming that the site is not serving active content at the time of analysis. Google Safe Browsing classifies the domain under the “social engineering” category, and the domain appears on one public security blocklist. PhishDestroy has also added the domain to its blocklist, and VirusTotal reports that eight of ninety‑five scanned scanners flagged the domain as malicious. The combined evidence raises the risk rating to elevated, despite the current offline state.

Uncertainties remain regarding the specific phishing campaign payload, target victims, or any credential‑harvesting pages, as no content beyond the 404 response has been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any reactivation, and add the name servers to watch lists for future sub‑domain registrations. Ongoing correlation with threat‑intel feeds that reference the same IP or certificate may reveal additional malicious actors. Regular re‑scanning of the domain is recommended to detect any future changes in status or content.