singo-coinbase[.]framer[.]ai

singo-coinbase.framer.ai is identified as a brand impersonation phishing domain targeting Coinbase users. The site is currently offline, but historical analysis indicates it was used to present a fraudulent login interface imitating a digital asset exchange service.

Infrastructure and telemetry data show the domain is flagged by 19/95 VirusTotal security vendors and appears on 2 independent security blocklists. The domain is associated with CSC Corporate Domains, Inc. as registrar, created on January 06, 2018. Network resolution points to IP 52.223.52.2, hosted under AS16509 Amazon.com, Inc. Additional indicators include SSL issuance via Let's Encrypt / E8 and a page title referencing “Log-in | Coinbase Pro | Digital Asset Exchange®”.

Although currently taken offline, the domain demonstrates confirmed impersonation infrastructure with prior phishing classification and multiple vendor detections. Users who interacted with the site should assume credential compromise risk and review account activity. Recommended mitigations include credential resets, session revocation, enabling multi-factor authentication, and monitoring for unauthorized access attempts. Continued blocking across DNS and web filtering systems is advised due to 19/95 detection ratio and multi-source blacklist presence.