sso-cinbasepro[.]framer[.]ai

Analysis of sso-cinbasepro.framer.ai shows a domain that has been actively used for malicious activity and is currently offline. The domain resolves to the Amazon Web Services address 35.71.142.77, which belongs to AS16509 (Amazon.com, Inc.) and is hosted in the United States. DNS resolution is served by four AWS Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). Registration was performed through CSC Corporate Domains, Inc. on January 6 2018, indicating the domain has existed for several years before being repurposed for abuse.

The site presents an HTTPS certificate issued by Let’s Encrypt (reference E8), but the HTTP response returns a 404 status with the page title “Site Not Found | Framer”, confirming that the content has been removed or taken down. Security telemetry records 11 of 95 VirusTotal scanners flagging the domain as malicious, and it appears on one external blocklist. PhishDestroy has listed the domain as blocked, reinforcing the assessment that it was employed in a phishing campaign. The listed scam type is a crypto scam, and the technology stack detected includes Framer Sites, React, HSTS, and HTTP/3, which are typical of legitimate modern web services but can be leveraged to host deceptive pages.

While the current offline status limits immediate threat to end users, the historical evidence demonstrates that the domain was used to host fraudulent content targeting cryptocurrency victims. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any re‑activation of the associated IP address or similar sub‑domains. Ongoing reconnaissance of the hosting provider and the registrar may reveal additional infrastructure used in the campaign, and analysts should treat any future appearance of the domain or its IP as high‑risk until verified safe.