en-coinbasecom-auth[.]framer[.]ai

Analysis of en-coinbasecom-auth.framer.ai shows a confirmed brand‑impersonation campaign targeting Coinbase users. The site returned an HTTP 404 status but presented the page title "Sign In | Coinbase.com - Log In," indicating an attempt to lure victims into entering credentials. The domain was created on 2018‑01‑06 and is hosted on Amazon Web Services (AS16509), resolving to IP address 52.223.52.2 located in the United States.

SSL was supplied by Let’s Encrypt (certificate identifier E8), and the server advertised HSTS and HTTP/3, suggesting a modern configuration consistent with the Framer Sites and React stack detected during fingerprinting. The registrar listed as CSC Corporate Domains, Inc. The domain appears on one security blocklist and has been taken offline by PhishDestroy. VirusTotal recorded 11 detections out of 95 scanners, and Google Safe Browsing flagged the domain for social engineering, reinforcing the malicious classification.

Defenders should continue to block the resolving IP and associated nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) in network perimeter controls, ingest the domain into internal threat feeds, and monitor for future registrations that reuse the same lexical patterns or hosting infrastructure. Given the high risk rating, security teams are advised to alert end‑user communities about the fraudulent login prompt and to enforce multi‑factor authentication for Coinbase accounts to mitigate credential compromise.