coinbase-pro-login-en[.]framer[.]ai

The domain coinbase-pro-login-en.framer.ai was created on January 06, 2018 and is registered through CSC Corporate Domains, Inc. DNS resolution points to the IPv4 address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The site employed a Let’s Encrypt certificate (E8) and supported modern transport protocols including HTTP/3, HSTS, and the React framework hosted on Framer Sites. The HTTP response returned a 404 status code, and the page title captured as "Coinbase Pro Login | Secure Sign In to Your Crypto Trading Account" directly references the Coinbase brand, confirming a brand‑impersonation intent.

Classification from the intelligence feed identifies the operation as a Crypto Scam targeting Coinbase users. Threat‑intel aggregators have recorded the domain on a single security blocklist, and VirusTotal analysis shows 11 of 95 scanning engines flagging the domain as malicious. The site has been taken offline and is listed as blocked by PhishDestroy.

While the domain is no longer active, its infrastructure—particularly the AWS‑hosted IP and associated name servers—remains observable and may be reused for future campaigns. defenders should continue to deny traffic to the resolved IP address, maintain the domain on blocklists, and monitor the listed name servers for any re‑registration attempts. Ongoing vigilance is advised given the elevated risk rating and the documented use of legitimate SSL certificates to lend credibility to the impersonation page.