connect-coinbase-pro-en[.]framer[.]ai

The domain connect-coinbase-pro-en.framer.ai was registered through CSC Corporate Domains, Inc. on January 06, 2018 and is hosted on Amazon infrastructure (IP 35.71.142.77, AS16509). DNS resolution uses four AWS Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and enforces HSTS over HTTP/3, indicating a modern web stack built with Framer Sites and React. Google Safe Browsing classifies the URL as social engineering, and VirusTotal reports that 10 of 95 security scanners flag the domain as malicious.

The domain appears on a single public blocklist and is listed as blocked by PhishDestroy. An HTTP request returns a 404 status, and the domain has been taken offline, limiting current content analysis. The page title captured from the site reads “Coinbase – Buy and Sell Bitcoin, Ethereum, and more with …”, confirming a direct brand impersonation aimed at cryptocurrency users. The intelligence aligns the activity with a crypto‑scam profile that leverages the Coinbase brand to lure victims.

While the offline state prevents verification of any credential‑harvesting forms, the combination of reputable hosting, a valid TLS certificate, and the observed title strongly suggests a deliberate brand‑spoofing campaign. Defenders should immediately add the domain to deny‑list rules at DNS and proxy layers, monitor for any re‑activation of the host, and correlate internal logs for connections to 35.71.142.77. Continuous re‑scanning with VirusTotal and similar services is advised to detect any changes in detection scores. Organizations using Coinbase services should reinforce user awareness of unsolicited URLs and enforce multi‑factor authentication to mitigate potential credential compromise.