access-coinpro-web-en[.]framer[.]ai

access-coinpro-web-en.framer.ai was observed hosting a page titled “Log‑in | Coinbase Pro | Digital Asset Exchange®”, a clear indication of an attempt to impersonate Coinbase’s professional trading platform. The site resolves to the Amazon Web Services address 35.71.142.77, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and is protected by a Let's Encrypt certificate (E8). Current HTTP response is 404, and the infrastructure has been taken offline, yet historical scans show the domain was flagged by Google Safe Browsing for social‑engineering and by nine of ninety‑five VirusTotal scanners. It appears on one external security blocklist and is actively blocked by PhishDestroy.

The authoritative name servers are ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, and ns‑635.awsdns, all belonging to AWS DNS services. The scam type is classified as a crypto scam, and the domain explicitly impersonates the Coinbase brand. Analysis indicates that the threat actor leveraged the framer.ai platform, a legitimate web‑design service, to host a counterfeit login page that mimics Coinbase Pro. Because the site now returns 404, direct content analysis is not possible, leaving the exact payload and credential‑harvesting mechanisms uncertain. However, the combination of brand‑specific page title, social‑engineering flag, and multiple vendor detections provides strong evidence of malicious intent.

Defenders should add 35.71.142.77 to network‑level blocklists, enforce DNS filtering for the full domain name, and monitor for any new subdomains under framer.ai that contain “coinbase” or similar branding. Existing email and web security gateways should be updated to flag the page title “Log‑in | Coinbase Pro | Digital Asset Exchange®” as a high‑confidence indicator of credential‑phishing.