begin-coienxsquere[.]framer[.]ai

The domain begin-coienxsquere.framer.ai is currently offline and returns an HTTP 404 response, but historical evidence indicates it was used for a Coinbase brand impersonation campaign. The site presented the page title "🔐 Coinbase Pro Login — Secure Access to Your Crypto Trading Account," directly targeting Coinbase users. Infrastructure analysis shows the domain resolves to IP address 35.71.142.77, hosted on Amazon Web Services (ASN 16509) and geolocated to the United States.

The domain was registered on January 6 2018 through CSC Corporate Domains, Inc., and is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). It employs a Let’s Encrypt/E8 TLS certificate and supports HSTS and HTTP/3, with the front‑end built on Framer Sites and React. Detection records show the domain appears on a single security blocklist and is listed by PhishDestroy.

VirusTotal scans flagged the domain by 11 of 95 security vendors, and Google Safe Browsing classifies it as a social‑engineering threat. While the site is no longer reachable, defenders should continue to block the domain at perimeter and email filters, monitor for any re‑registration of the same second‑level name or similar framer.ai subdomains, and update threat‑intel feeds with the observed indicators (IP 35.71.142.77, registrar CSC Corporate Domains, and the specific page title). Given the confirmed brand impersonation and multiple detection sources, the domain represents a high‑risk credential‑harvesting vector targeting cryptocurrency users.