base-coines[.]framer[.]ai

Analysis indicates that the domain base-coines.framer.ai is actively used to impersonate Coinbase, specifically targeting users of Coinbase Pro. The site presents the page title “Coinbase Pro Login: Trade Crypto Safely and Efficiently,” which aligns with the brand target. The domain is hosted on Amazon Web Services (AS16509) and resolves to 52.223.52.2, a US‑based IP address. The SSL certificate is issued by Let’s Encrypt (issuer E8), providing HTTPS but offering no assurance of legitimacy.

Technical fingerprints show the presence of Framer Sites and a React front‑end, with HTTP Strict Transport Security (HSTS) and HTTP/3 enabled, suggesting a modern web stack. VirusTotal reports that nine of ninety‑three scanning engines have flagged the domain, indicating a moderate level of detection across security vendors. Google Safe Browsing categorizes the site as a social engineering threat, and the domain appears on at least one dedicated phishing blocklist. It has been registered through CSC Corporate Domains, Inc., a registrar commonly used for disposable or bulk registrations.

Independent anti‑phishing services such as PhishDestroy have already blocked the domain, and the current HTTP response is a 404, implying the site has been taken offline at the time of observation. The available evidence confirms a crypto‑related impersonation campaign, but the exact content served, credential‑harvesting mechanisms, and any associated command‑and‑control infrastructure remain unknown because the site is no longer reachable. Defenders should add the domain and its associated IP address to blocklists, monitor for similar subdomains under the framer.ai namespace, and update email and web filtering rules to flag any references to “Coinbase Pro Login” originating from non‑official Coinbase domains. Continuous observation of the registrar CSC Corporate Domains, Inc. for new registrations that mimic financial brands is also advised.