get-coin-bes-ask[.]framer[.]ai

The domain get-coin-bes-ask.framer.ai is confirmed as a cryptocurrency‑related impersonation site targeting Coinbase users. Registration data show the name was created on January 06, 2018 and is hosted through CSC Corporate Domains, Inc. The domain resolves to IP address 35.71.142.77, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. DNS resolution uses four Amazon Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presented an HTTPS certificate issued by Let’s Encrypt (certificate identifier “E8”), indicating a valid TLS handshake but offering no trust beyond the certificate authority. The page title returned by the server was “Coinbase Pro® Login™ © – Quick & Secure Access™”, directly referencing Coinbase’s brand and suggesting a credential‑harvesting intent.

HTTP response code was 404, implying the content was removed or never served at the time of testing, and the site is currently marked offline. Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded detections from 7 of 95 security vendors, reinforcing the malicious classification. The infrastructure was built with Framer Sites and React, and it enforced HSTS and HTTP/3, which are typical of modern phishing kits. The domain appears on one public security blocklist and has been blocked by PhishDestroy.

While the site is no longer reachable, defenders should still ingest the observed indicators—domain name, IP address, name server set, SSL fingerprint, and page title—into detection pipelines. Network defenders should update DNS and URL filtering rules to block the domain and associated IP, and endpoint security solutions should be configured to flag any traffic to this host. Threat hunters should monitor for similar Framer‑based impersonation campaigns against Coinbase, as the reuse of the same hosting and certificate patterns suggests a template may be in active use.