coinbaselogin[.]framer[.]ai

The domain coinbaselogin.framer.ai was identified as a high‑risk brand‑impersonation site targeting Coinbase users. The domain was created on 06 January 2018 and is registered through CSC Corporate Domains, Inc. Its authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, indicating it is hosted on Amazon Web Services. DNS resolution points to IP 35.71.142.77, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site presented an SSL certificate issued by Let’s Encrypt (identifier E8), and the HTTP response returned a 404 status code at the time of collection, suggesting the malicious page was removed or taken offline. Technical fingerprinting revealed the use of Framer Sites, React, HSTS and HTTP/3, consistent with a modern web‑application framework often abused in phishing kits.

Detection evidence shows that the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal recorded 12 detections out of 95 scanned security vendors, and Google Safe Browsing classified the URL as a social‑engineering threat. The page title recorded in the collection, "Coinbase Login: Complete Guide to Accessing Your Professional Crypto Account," directly references the Coinbase brand, confirming the impersonation intent. The scam type is logged as a crypto‑scam, aligning with the brand target.

While the site is currently offline, the infrastructure—AWS hosting, Let’s Encrypt certificate, and the specific Framer‑based front‑end—remains reusable for future campaigns. Defenders should therefore add coinbaselogin.framer.ai to URL filtering and DNS block lists, monitor other subdomains under the framer.ai namespace for similar patterns, and enforce strict outbound filtering for traffic to newly registered domains that resolve to Amazon‑owned IP ranges.