coinbasse-login[.]framer[.]ai

The domain coinbasse-login.framer.ai is currently offline but exhibits multiple indicators of a high‑risk brand‑impersonation campaign targeting Coinbase users. Registration data shows the domain was created on 2018‑01‑06 through CSC Corporate Domains, Inc., and the hosting infrastructure is identified as Amazon Web Services (ASN 16509) located in the United States. DNS resolution points to IP address 52.223.52.2 and the authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The site served an SSL certificate from Let’s Encrypt (certificate identifier E8) and advertised modern web technologies including Framer Sites, React, HSTS, and HTTP/3, yet the HTTP response returned a 404 status code, suggesting the malicious content may have been removed or is otherwise inaccessible.

Google Safe Browsing classifies the site under social‑engineering threats, and VirusTotal records indicate that 11 of 95 scanned security vendors flagged the domain as malicious. The page title "Coinbase Pro Login | Secure Crypto Trading Access Guide" directly references the Coinbase brand, confirming the impersonation intent. The domain appears on one public security blocklist and has been actively blocked by PhishDestroy.

While the site is no longer reachable, its historical footprint demonstrates a deliberate attempt to lure cryptocurrency traders into a fake login flow. Defenders should ensure the domain is added to outbound filtering rules, monitor the associated IP range for re‑use, and incorporate the observed TLS fingerprint and DNS name server pattern into threat‑intel feeds. Continuous verification of the domain’s status is advised, as the infrastructure could be repurposed for future impersonation attempts.