coinnesbase-loginse[.]framer[.]ai

On July 25, 2026 analysts observed that the domain coinnesbase-loginse.framer.ai is currently offline but retains multiple indicators of a credential‑stealing operation targeting the Coinbase brand. The site was registered through CSC Corporate Domains, Inc. on January 06, 2018 and is hosted on Amazon Web Services (AS16509) in the United States, resolving to IP 52.223.52.2. The TLS certificate is issued by Let’s Encrypt (E8) and the service advertised HSTS and HTTP/3 support. The page title returned by the server, “Coinbase Pro Login – Safe Access to Advanced Crypto Trading,” directly references Coinbase’s professional trading platform, confirming the impersonation intent.

Google Safe Browsing categorises the domain as social engineering, and nine of ninety‑five VirusTotal scanners flagged the host as malicious. PhishDestroy has added the domain to its blocklist, and it appears on one additional security blocklist. The HTTP response code is 404, indicating the page is no longer serving content, which aligns with the reported offline status. Detected technologies include Framer Sites and React, consistent with a quickly assembled phishing front‑end.

While the offline status limits immediate threat to active victims, the infrastructure—particularly the use of a reputable CDN and a valid SSL certificate—demonstrates a typical evasion pattern that could be re‑used for future campaigns. Defenders should continue to monitor the associated IP address and AWS nameservers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns) for any re‑activation, enforce strict email and web filtering for URLs containing “coinbase” or “framer.ai”, and consider adding the domain to local blocklists. Incident response teams should also verify that no credential leakage has occurred for Coinbase users and advise affected customers to change passwords if any interaction with the domain is suspected.