coinbase-pro-logiin[.]framer[.]ai

The domain coinbase-pro-logiin.framer.ai was registered on April 04, 2023 through CSC Corporate Domains, Inc. and is currently taken offline, returning an HTTP 404 status. The site previously served a page titled "Coinbase Pro Login | How to Access and Trade Securely in 2025," directly targeting the Coinbase brand and fitting the crypto‑scam profile. Technical analysis shows the site was built on Framer Sites with a React front‑end, employed HSTS and HTTP/3, and delivered a Let’s Encrypt (E8) TLS certificate. DNS resolution points to the IP address 52.223.52.2, owned by Amazon.com, Inc. (AS16509) and located in the United States.

The domain’s authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. Google Safe Browsing classified the site as social engineering, and it appears on one security blocklist. VirusTotal reports that 14 of 93 scanning engines flagged the domain, indicating a measurable level of malicious confidence. The domain was also flagged and blocked by PhishDestroy, reinforcing its association with phishing infrastructure.

While the site is presently offline, the combination of brand impersonation, crypto‑focused page title, and multiple independent detections suggests a deliberate attempt to harvest credentials for Coinbase Pro accounts. Defenders should ensure that the domain is added to network‑level blocklists, monitor for any resurrection of the same DNS records or similar Framer‑based URLs, and consider extending filtering rules to include the associated IP range and name servers. Continuous vigilance of inbound traffic for requests to the domain or its hosting infrastructure, combined with user awareness campaigns about unsolicited Coinbase login prompts, will reduce exposure to this specific threat vector.