coinnbase-logine[.]framer[.]ai

Analysis of coinnbase-logine.framer.ai, observed on July 25 2026, indicates that the domain is being used for brand impersonation of Coinbase. The site presents the page title “Coinbase Pro Login – Sign In to Trade Cryptocurrency Securely,” which aligns with the declared target brand. VirusTotal records show nine of ninety‑five security vendors flag the domain, demonstrating a moderate detection consensus. Google Safe Browsing classifies the domain as social engineering, reinforcing the phishing assessment. The domain resolves to IP address 52.223.52.2, an Amazon Web Services host located in the United States under ASN 16509 (Amazon.com, Inc.).

The HTTP response currently returns a 404 status, and the website is reported as taken offline. The TLS certificate is issued by Let’s Encrypt (E8), providing encryption but not authenticity. Registration metadata reveal creation on 6 January 2018 through CSC Corporate Domains, Inc., and the authoritative name servers are ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, and ns‑635.awsdns. Detected web technologies include Framer Sites, React, HSTS, and HTTP/3, which are typical of modern web applications but do not imply benign intent. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

While the current offline status limits immediate threat exposure, the combination of brand‑specific page title, multi‑vendor detection, Safe Browsing flag, and hosting on a cloud provider suggests a deliberate phishing infrastructure. Defenders should add the domain and its resolved IP to network and endpoint blocklists, monitor for any re‑activation or related subdomains, and enforce outbound filtering for user agents attempting to contact the domain. Continuous observation of the registrar CSC Corporate Domains, Inc. for new registrations with similar naming patterns is advisable.