portal-coin-base-login[.]framer[.]ai

The domain portal-coin-base-login.framer.ai was observed resolving to the IPv4 address 52.223.52.2, which is hosted in the United States under ASN 16509 belonging to Amazon.com, Inc. The site was built with Framer Sites and React, and it served over TLS using a Let’s Encrypt certificate (E8). HTTP/3 and HSTS were detected, and the server returned a 404 status code at the time of inspection. The page title returned by the web server reads “Coinbase Pro Login | Secure Access to Coinbase Advanced Trade (2025 Guide)”, explicitly referencing the Coinbase brand. Registration data indicates the domain was created on 2018‑01‑06 through CSC Corporate Domains, Inc., and the authoritative nameservers are the standard AWS‑provided set (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns).

VirusTotal scans show that five out of ninety‑five security vendors flagged the domain as malicious, and the domain appears on at least one public blocklist, specifically PhishDestroy, which has already taken the site offline. The intelligence categorises the activity as a crypto‑related scam that impersonates Coinbase, but no further technical artifacts such as payloads, C2 infrastructure, or credential‑harvesting forms have been disclosed. Consequently, analysts cannot confirm the exact phishing kit or the method used to capture user credentials.

Defenders should block DNS resolution for the domain and any sub‑domains, add the associated IP address to outbound deny lists, and monitor for any outbound connections to the AWS ASN that may indicate related infrastructure. Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any new detections, and threat‑intel feeds should be updated to reflect the presence of this brand‑impersonation vector. Incident response teams should also verify that no legitimate internal services are inadvertently using the same AWS resources, to avoid false positives.