portal-coinbasepro[.]framer[.]ai

Analysis of the domain portal-coinbasepro.framer.ai indicates an elevated-risk brand impersonation campaign targeting Coinbase users, currently offline as of July 24, 2026. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the use of AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns) and a Let's Encrypt SSL certificate (serial E8), suggesting an attempt to appear legitimate through standard security practices. The page title, 'Coinbase Pro Login | Sign In,' directly aligns with the reported scam type of a crypto scam, indicating an intent to deceive users into entering credentials on a fraudulent platform.

While the domain is flagged by 8 of 95 security vendors on VirusTotal and appears on one security blocklist (PhishDestroy), the HTTP status returned a 404 at the time of analysis, confirming its current offline status. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not inherently indicate malicious activity. Defenders should note that the domain's creation date predates the observed phishing activity, which may suggest either a compromised legitimate domain or a strategic registration to evade immediate suspicion.

The use of a well-known registrar and reputable hosting provider further complicates attribution, as these services are frequently abused by threat actors to blend in with legitimate traffic. Given the domain's association with Coinbase impersonation and its presence on security blocklists, organizations are advised to proactively block access to portal-coinbasepro.framer.ai and monitor for similar domains leveraging the Framer.ai subdomain structure or AWS-hosted infrastructure.