base-coin-logins[.]framer[.]ai

Analysis of base-coin-logins.framer.ai confirms high-risk crypto phishing infrastructure targeting Coinbase users. The domain, registered on April 4, 2023, through CSC Corporate Domains, Inc., resolves to IP 52.223.52.2 (US, AS16509 Amazon.com, Inc.) and was actively serving content under the page title 'Coinbase Pro Login – Secure Access to Your Crypto Account.' Google Safe Browsing flagged the site for social engineering, and PhishDestroy blocked it as a crypto scam. Eleven of 93 security vendors on VirusTotal detected the domain as malicious.

The site used a Let's Encrypt SSL certificate (E8) and employed Framer Sites, React, HSTS, and HTTP/3 technologies, indicating a modern, hosted phishing kit rather than a compromised server. HTTP status returned a 404 at the time of assessment, suggesting the page was taken offline following detection. Nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) further link the domain to AWS-hosted infrastructure.

The combination of brand impersonation, crypto-specific scam classification, and multiple vendor detections provides concrete evidence of fraudulent intent. Defenders should treat this domain as confirmed malicious, block all resolutions, and monitor for related infrastructure using the same registrar, hosting provider, or SSL issuer patterns. While the page is offline, the registration date and hosting setup suggest potential for rapid redeployment under a new subdomain or similar domain structure.