my-coinbaspro-auth[.]framer[.]ai

Analysis of the domain my-coinbaspro-auth.framer.ai, observed on July 23, 2026, indicates that it is currently offline but was previously associated with a generic phishing campaign. The domain was registered on 2018-01-06 through CSC Corporate Domains, Inc., and is hosted on Amazon’s infrastructure (ASN 16509) with the IPv4 address 52.223.52.2 located in the United States. DNS resolution uses four AWS name servers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The site presented a 404 HTTP status and the page title “Site Not Found | Framer,” confirming that no landing content was reachable at the time of inspection.

TLS inspection shows a Let’s Encrypt certificate (identifier E8), which is typical for short‑lived malicious sites. Automated scanning on VirusTotal recorded 12 detections out of 95 security vendors, indicating moderate consensus that the domain is malicious. The domain appears on a single external blocklist and is listed by PhishDestroy, reinforcing its classification as a phishing resource. Detected web technologies include Framer Sites, React, HTTP Strict Transport Security (HSTS) and HTTP/3, which are common in legitimate Framer‑hosted pages but do not mitigate the underlying threat.

The available evidence confirms that the domain was used for phishing, yet the specific brand or credential‑stealing vector targeted by the campaign has not been disclosed. Consequently, analysts cannot determine the exact spoofed service or the content of any credential‑capture form. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any resurgence of activity from the associated IP address or name servers. Ongoing vigilance is advised because the hosting provider may allocate the same infrastructure to new malicious domains in the future.