coinsvase-login[.]framer[.]ai

Analysis of the domain coinsvase-login.framer.ai indicates a high-risk brand impersonation campaign targeting Coinbase users, specifically mimicking the Coinbase Pro login interface. The domain, registered through CSC Corporate Domains, Inc. on January 6, 2018, presents a page title 'Coinbase Pro Login – Access Your Secure Crypto Trading Dashboard,' directly referencing Coinbase's cryptocurrency trading platform. Google Safe Browsing has flagged this domain for social engineering, while VirusTotal reports detection by 10 of 95 security vendors, corroborating its malicious classification. The domain is currently offline, returning an HTTP 404 status, and appears on at least one security blocklist, including PhishDestroy.

Infrastructure analysis reveals the domain resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc.'s network (AS16509) in the United States. The site employs Framer Sites and React technologies, alongside HSTS and HTTP/3, suggesting a modern, potentially sophisticated phishing framework. Nameservers are hosted under AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), and the SSL certificate is issued by Let's Encrypt, which does not inherently indicate legitimacy due to its widespread use in both legitimate and malicious domains. While the domain is currently inactive, its historical use for crypto scam activity and direct impersonation of Coinbase Pro warrants continued monitoring.

Defenders should block this domain at the DNS and proxy levels, and review logs for prior connections from internal networks. Given the domain's registration date predates its malicious use, it may have been compromised or repurposed for phishing. Further investigation into associated IPs, certificates, and hosting patterns is recommended to identify related infrastructure.