pro-coinbase-login[.]framer[.]ai

The domain pro-coinbase-login.framer.ai has been identified as a brand‑impersonation infrastructure targeting Coinbase users. The site presented the page title "Coinbase Pro Login – Access Your Advanced Trading Account Safely," indicating an attempt to lure victims into credential harvesting. Technical analysis shows the domain was created on January 06, 2018 and is registered through CSC Corporate Domains, Inc. It resolves to the IP address 52.223.52.2, which is hosted in the United States and associated with AS16509 Amazon.com, Inc. The hosting environment serves content via Framer Sites and React, with security headers such as HSTS enabled and support for HTTP/3. The TLS certificate is issued by Let's Encrypt (type E8).

An HTTP request to the root returned a 404 status, suggesting the malicious landing page may have been removed or taken offline; current status is listed as offline. Detection telemetry indicates that 11 of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one external blocklist. The domain has also been blocked by the PhishDestroy service. Nameservers listed are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

Although the site is no longer active, the infrastructure remains observable and could be repurposed for future campaigns. Defenders should add the domain and its resolved IP address to outbound web filtering and DNS sinkhole rules, enforce strict outbound traffic monitoring to Amazon AWS ranges, and ensure that any credential leakage related to Coinbase is investigated. Continuous monitoring of the associated IP block and the registrar CSC Corporate Domains, Inc. is recommended to detect possible re‑use of the same hosting resources for new malicious payloads.