auth-coinbase-pro-log[.]framer[.]ai

Analysis of auth-coinbase-pro-log.framer.ai shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain, created on 6 January 2018 and registered via CSC Corporate Domains, Inc., resolves to the Amazon Web Services address 35.71.142.77, which is announced by ASN 16509 (Amazon.com, Inc.) and located in the United States. The hosting infrastructure hosts a site built with Framer Sites and React, serves HTTP/3 traffic, and enforces HSTS. The TLS certificate is issued by Let’s Encrypt (E8), indicating a legitimate‑looking encryption layer. The site’s page title is “Coinbase – Sign in,” matching the targeted brand and confirming the impersonation intent.

Detection data show that the domain appears on one security blocklist and has been flagged by Google Safe Browsing for social‑engineering content. VirusTotal records indicate that 11 out of 95 scanning engines have classified the domain as malicious, and PhishDestroy has also blocked it. The HTTP response is a 404 status, suggesting the landing page is no longer reachable, and the current offline status is confirmed. Nameserver configuration includes ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, and ns‑635.awsdns, all belonging to AWS DNS services, reinforcing the use of Amazon‑hosted infrastructure. The combination of brand‑specific page title, high‑confidence vendor detections, and hosting on a reputable cloud provider is typical of credential‑harvesting operations that rely on trusted TLS and familiar domain structures to evade user suspicion.

Uncertainty remains regarding the exact content that was served before the site went offline, as the 404 response provides no visible payload. No additional intelligence such as phishing email samples or victim reports is presently available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration of the sub‑domain or similar‑looking framer.