welcome-coinpro-x-cdn[.]framer[.]ai

The domain welcome-coinpro-x-cdn.framer.ai is flagged as a brand‑impersonation campaign targeting Coinbase users. Technical investigation shows the domain resolves to IP address 52.223.52.2, which is hosted on Amazon Web Services (ASN16509) in the United States. DNS resolution is serviced by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and currently presents a valid Let's Encrypt SSL certificate (E8). The site advertises a page title of “Coinbase Pro Login – Secure Sign In”, matching the declared brand target of Coinbase and the scam type of a crypto‑draining operation.

Security telemetry indicates that ten of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site is listed on a single external blocklist. It has been explicitly blocked by the PhishDestroy service. Infrastructure analysis reveals the use of Framer Sites and a React front‑end, with HTTP security features such as HSTS and support for HTTP/3 enabled. An HTTP request to the host returns a 404 status code, and the current operational status is marked offline.

While the HTTP response suggests the content is no longer served, the presence of the aforementioned indicators confirms that the domain was employed for credential‑stealing activity. Uncertainty remains regarding the exact payload or form used, as the 404 response prevents retrieval of page content. Defenders should add the domain and its hosting IP to network‑level blocklists, monitor for new subdomains under framer.ai that exhibit similar technology stacks, and enforce strict TLS verification to avoid accepting self‑signed or improperly issued certificates. Continuous observation of the registrar CSC Corporate Domains, Inc. for future registrations may also help anticipate related campaigns.