sso-coinbase-pro-login[.]framer[.]ai

The domain sso-coinbase-pro-login.framer.ai was identified as a brand‑impersonation site targeting Coinbase users. Technical profiling shows the site was built on Framer Sites with a React front‑end, employing HSTS and HTTP/3. DNS resolution points to the IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free certificate authority. An HTTP request returned a 404 status code, indicating the page is not currently serving content.

The page title retrieved earlier reads "Coinbase Pro Login | Access Your Account via Coinbase Advanced Trade (2025)", directly referencing Coinbase and suggesting a crypto‑related phishing campaign. Registration data lists CSC Corporate Domains, Inc. as the registrar and the domain was created on 06 January 2018. Nameserver configuration includes ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming AWS DNS services. The domain appears on one security blocklist and has been flagged by PhishDestroy as taken offline.

VirusTotal analysis shows nine of ninety‑five scanners flag the domain as malicious, reinforcing the suspicion of a crypto scam. While the site is currently offline, the infrastructure—AWS hosting, Let’s Encrypt TLS, and the use of modern web protocols—remains reusable for future impersonation attempts. Defenders should block the domain and its associated IP at perimeter devices, monitor the listed nameservers for new subdomains, and add the domain hash to internal threat‑intel feeds. Continuous re‑scanning of the IP and any newly observed hosts in the same ASN is recommended to catch potential re‑use of the same infrastructure for further Coinbase‑related fraud.