base-coinpro[.]framer[.]media

Analysis indicates base-coinpro.framer.media was a brand-impersonation domain targeting Coinbase users, operational until recently taken offline. The domain resolved to 52.223.52.2 (US, AS16509 Amazon.com, Inc.) and used nameservers ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1.awsdns-00.com, suggesting AWS-hosted infrastructure. A Let's Encrypt SSL certificate (serial E7) was issued, and HTTP Strict Transport Security (HSTS) was enabled, consistent with phishing sites attempting to appear legitimate. The page title 'Coinbase Pro Login® - Accessing Coinbase Advanced*' explicitly references Coinbase Pro, a discontinued service, indicating an attempt to trick users into entering credentials for a defunct platform.

Technical evidence includes detection by 11 of 93 security vendors on VirusTotal and a presence on one security blocklist (PhishDestroy). The domain was registered through CSC Corporate Domains, Inc., a registrar commonly used for both legitimate and malicious domains. Technologies detected include Framer Sites and React, which are occasionally leveraged by threat actors for rapid deployment of convincing landing pages. The domain returned an HTTP 404 status at the time of assessment, suggesting it has been disabled or removed.

Defenders should treat this domain as a confirmed crypto scam targeting Coinbase users. While the site is currently offline, the infrastructure remains a potential risk if reactivated. Network-level blocking of 52.223.52.2 and monitoring for re-registration or DNS changes is recommended. No additional page content or payloads have been analysed, so further investigation into associated malware or credential-harvesting mechanisms is advised if logs or telemetry indicate user interaction with this domain.