conis-we[.]framer[.]ai

Analysis of the domain conis-we.framer.ai shows a deliberately crafted credential‑harvesting page that mimics Coinbase services. The site was registered on January 06, 2018 through CSC Corporate Domains, Inc., and is hosted on Amazon Web Services (ASN 16509) in the United States, resolving to IP 52.223.52.2. A Let’s Encrypt certificate (E8) was in place, and the server announced HSTS and HTTP/3 support, indicating a modern web stack built with Framer Sites and React. The page title returned by the server, "Coinbase Pro Login Page – Manage Your Digital Assets Safely," directly references the Coinbase brand, confirming the impersonation claim.

HTTP probing returned a 404 status, and the site has since been taken offline, as indicated by the current status flag. Security telemetry shows the domain appears on one public blocklist and is specifically blocked by PhishDestroy. VirusTotal scans recorded 13 detections out of 95 security vendors, reinforcing the malicious classification.

While the offline state limits immediate exploitation, the infrastructure—particularly the use of a reputable cloud provider and a valid TLS certificate—demonstrates an effort to gain user trust. Defenders should continue to monitor the associated IP address (52.223.52.2) and the four AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) for any re‑use, enforce domain‑based blocklists that include this indicator, and advise users to verify URLs when accessing Coinbase services. Incident response teams should treat any login attempts to this domain as compromised and advise affected users to reset credentials and review account activity.