us-coinbase-pro-login[.]framer[.]ai

Analysis of us-coinbase-pro-login.framer.ai indicates that the domain is actively leveraged for a cryptocurrency‑related brand impersonation campaign targeting Coinbase users. The site resolves to IP address 35.71.142.77, which belongs to the Amazon Web Services network (AS16509, United States). DNS records are served by four AWS Route 53 nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and the TLS certificate is issued by Let’s Encrypt (certificate identifier “E8”), providing standard HTTPS encryption and HSTS enforcement. An HTTP request returns a 404 status, suggesting that the malicious landing page may have been removed or is served conditionally.

The page title observed during the short‑lived fetch is “What Happened to Coinbase Pro? – Investopedia”, which aligns with the declared brand target of Coinbase and the scam classification as a crypto scam. Fingerprinting tools identify the presence of Framer Sites, React, and HTTP/3, confirming the use of modern web‑application frameworks. Reputation data show that the domain is listed on a single security blocklist and has been blocked by the PhishDestroy service.

VirusTotal analysis records six positive detections out of ninety‑five scanners, reinforcing the suspicion of malicious intent. No additional public intelligence such as OTX or Safe Browsing entries is currently available. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the listed nameservers, and add the IP address to threat‑intel feeds. Further investigation of the underlying AWS resources may reveal additional campaign components, and continuous re‑scanning is advised to capture any changes in the site’s content or status.