eng-coine-base[.]framer[.]ai

This domain, eng-coine-base.framer.ai, was observed hosting a counterfeit Coinbase onboarding page titled “How to Create Coinbase Pro Account 2024 (Step‑By‑Step)”. The site resolved to the Amazon Web Services IP address 35.71.142.77, which belongs to AS16509 (Amazon.com, Inc.) and is geolocated in the United States. Registration data shows the domain was created on 6 January 2018 through CSC Corporate Domains, Inc., and is served by the AWS Route 53 nameservers ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, and ns‑635.awsdns. The TLS certificate is issued by Let’s Encrypt (certificate identifier E8) and the server advertised HTTP/3 and HSTS.

An HTTP request returned a 404 status code, indicating that the page is no longer accessible; the domain has since been taken offline and is listed as blocked by the PhishDestroy feed. VirusTotal recorded 7 detections out of 95 scanned scanners, and the domain appears on one external blocklist. Google Safe Browsing flags the site for social engineering, reinforcing the classification as a crypto‑related brand impersonation campaign targeting Coinbase users. The observed technology stack includes Framer Sites and React, consistent with the use of modern front‑end frameworks to mimic legitimate services.

Risk is assessed as elevated given the combination of confirmed brand misuse, active detection by multiple security vendors, and the presence of a valid SSL certificate that could lend credibility to victims. Defenders should continue to monitor the IP address 35.71.142.77 for any future re‑use, enforce outbound filtering for the domain and its associated hostnames, and update internal blocklists. Incident response teams should also correlate any user reports of fraudulent Coinbase login prompts with this indicator and consider notifying affected customers that the malicious page is no longer reachable but that similar impersonation attempts remain active across the threat landscape.