coinbase-pr-logine[.]framer[.]ai

Analysis of coinbase-pr-logine.framer.ai shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered through CSC Corporate Domains, Inc. and uses four AWS Route 53 nameservers (ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, and an incomplete fourth entry), indicating hosting on Amazon infrastructure. DNS resolution points to IP 52.223.52.2, which belongs to AS16509 Amazon.com, Inc., located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8), and the connection advertised HSTS and HTTP/3, consistent with modern web stacks.

Technology fingerprinting detected Framer Sites, React, and the presence of HSTS, suggesting the page was built with the Framer platform. The HTTP response returned a 404 status, meaning the content is no longer accessible, but historical data recorded a page title of "Coinbase Pro Login | Step‑by‑Step Access for Advanced Crypto Traders," directly referencing the Coinbase brand and indicating a crypto‑scam theme. Google Safe Browsing flags the domain for social engineering, and the site appears on one external security blocklist. VirusTotal scanned the domain and 13 of 93 antiviruses flagged it as malicious, reinforcing the suspicion.

PhishDestroy has already blocked the domain, and the current status is taken offline. While the exact payload or credential‑harvesting page cannot be examined due to the 404 response, the convergence of brand‑specific page title, crypto‑scam classification, reputable blocklist entries, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and consider adding the associated IP range to deny‑lists. Organizations should also alert users about the potential Coinbase impersonation and reinforce the use of verified Coinbase URLs for any account activity.