en-coinbssecom-auth[.]framer[.]ai

en-coinbssecom-auth.framer.ai was observed hosting a credential‑collection page that mimics Coinbase, as indicated by the page title “Sign In | Coinbase.com - Log In”. The site was registered through CSC Corporate Domains, Inc. on 6 January 2018 and is served from Amazon AWS infrastructure (ASN 16509) with the public IP 35.71.142.77 located in the United States. TLS is provided by Let’s Encrypt (certificate identifier E8) and the server advertises HSTS and HTTP/3, while the underlying stack includes Framer Sites and React. Automated scans returned an HTTP 404 response, suggesting the landing page is no longer reachable; the domain is currently listed as offline.

Google Safe Browsing classified the domain as social engineering, and PhishDestroy added it to a blocklist. VirusTotal recorded 14 detections out of 95 scanners, confirming malicious classification. The domain appears on one additional security blocklist and carries a Scamadviser trust score of 30 / 100, reinforcing the low reputation. Nameservers ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk and ns‑635.awsdns indicate standard AWS DNS configuration.

While the exact phishing kit or payload has not been recovered, the convergence of brand impersonation, crypto‑scam labeling, and multiple vendor detections provides strong evidence of a credential‑ harvesting operation targeting Coinbase users. Defenders should block the domain at network perimeter, update URL filtering lists, and monitor for any authentication attempts to Coinbase originating from the IP address 35.71.142.77. Incident response teams should also inspect logs for login attempts that may have been redirected to this host and advise users to verify URLs before entering credentials.