sso-coinbsepro-auth[.]framer[.]ai

Analysis dated July 25, 2026 identifies the domain sso-coinbsepro-auth.framer.ai as a brand‑impersonation site targeting Coinbase users. The domain was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is hosted on Amazon infrastructure (AS16509) with the IP address 52.223.52.2 located in the United States. Infrastructure inspection shows the site runs Framer Sites and React, enforces HSTS, and supports HTTP/3. The TLS certificate is issued by Let’s Encrypt (E8) and matches the host name. DNS resolution uses four Amazon Route 53 nameservers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

HTTP probing returned a 404 status, and the page title captured was “Log‑in | Coinbase Pro | Digital® Asset Exchange*”, confirming the intent to mimic Coinbase’s login interface. Threat intelligence indicates the domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans show eight of ninety‑five AV engines flag the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The site is currently offline, and its status is recorded as taken offline.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the title has been examined. Defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any re‑hosting attempts on similar subdomains. Incident response teams should advise users not to enter credentials on any site presenting the captured page title and to verify URLs against official Coinbase domains. Continuous monitoring of the associated IP range and related DNS records is recommended to detect potential redeployment of the impersonation kit.