io-coinbaseprologin[.]framer[.]ai

This domain, io-coinbaseprologin.framer.ai, was observed hosting a page titled “Coinbase Pro Login – Secure Access to Advanced Crypto Trading”. The title directly references Coinbase’s professional trading platform, indicating a brand‑impersonation attempt aimed at credential harvesting for cryptocurrency accounts. The site is built on Framer Sites and uses React, with HTTP/3 enabled and HSTS enforced, suggesting a relatively modern web stack. The TLS certificate is issued by Let’s Encrypt (E8) and is currently valid, which can lend superficial credibility to the page. Registration details show the domain was created on 6 January 2018 through CSC Corporate Domains, Inc., and the authoritative name servers are the standard Amazon Route 53 set (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns).

DNS resolution points to 52.223.52.2, an IP owned by Amazon.com, Inc., AS16509, located in the United States. VirusTotal scans returned 10 detections out of 95 scanners, and the domain appears on one external security blocklist. It has also been listed by PhishDestroy as a malicious resource. HTTP requests now return a 404 status and the domain is marked offline, indicating that the phishing page has been taken down, but the underlying infrastructure remains observable.

Evidence confirms the domain is designed to masquerade as a Coinbase Pro login portal and is classified as a crypto‑related scam. However, the exact phishing kit or any captured credentials have not been publicly released, and the current activity level is unknown beyond the offline status. Defenders should continue to block the domain at network perimeter controls, update any URL filtering lists with the observed host, and monitor for re‑use of the associated IP address or similar Framer‑based impersonation campaigns. Incident responders should also consider notifying affected Coinbase users of potential credential compromise if logs show traffic to this host.