holdings-sig-coinbase[.]framer[.]ai

Analysis indicates that the domain holdings-sig-coinbase.framer.ai is a high-risk brand impersonation site targeting Coinbase users. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and currently resolves to IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the use of Framer Sites and React, with HTTP Strict Transport Security (HSTS) and HTTP/3 enabled, suggesting a modern web framework designed to appear legitimate. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate sites and malicious actors due to its free and automated nature.

The page title 'Coinbase Sign In' explicitly matches the branding of the cryptocurrency exchange Coinbase, aligning with the known scam type classified as a crypto scam. Google Safe Browsing has flagged this domain for social engineering, a designation consistent with phishing or fraudulent login pages. The domain appears on one security blocklist and is actively blocked by PhishDestroy. While the domain is currently offline, returning an HTTP 404 status, historical data from VirusTotal shows that 13 out of 95 security vendors previously flagged this domain as malicious.

Nameservers associated with the domain are hosted on AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns), a common infrastructure choice for both legitimate services and threat actors. The combination of AWS hosting, a Coinbase-branded page title, and detection by multiple security vendors strongly suggests this domain was used for fraudulent login credential harvesting. Defenders should treat this domain as confirmed malicious and prioritize blocking it at DNS, proxy, and endpoint levels. Further investigation into related domains or IPs may uncover additional infrastructure linked to this campaign.