guide-coinbse-pro[.]framer[.]website

Analysis of guide-coinbse-pro.framer.website shows a brand‑impersonation campaign targeting Coinbase users. The domain was registered on November 19, 2021 through CSC Corporate Domains, Inc., and uses four Amazon Route 53 nameservers (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns). The site served a TLS certificate from Let’s Encrypt (issuer E7) and advertised HSTS and HTTP/3, indicating a modern web stack built on Framer Sites and React. When queried, the HTTP response returned a 404 status, and the site is currently taken offline, with PhishDestroy listing it as blocked.

Infrastructure points to Amazon Web Services, specifically AS16509 (Amazon.com, Inc.), with the domain resolving to IP 52.223.52.2 located in the United States. VirusTotal recorded 11 detections out of 93 security vendors, confirming malicious classification, and the domain appears on one external blocklist. The page title captured by scanners reads “Login to Coinbase Pro – Secure Wallet Access,” matching the declared scam type of a crypto scam and confirming the intent to lure victims into credential harvesting.

What remains uncertain is the current activity level, as the site is offline and no live payload has been observed; however, the combination of a brand‑specific title, reputable hosting, and multiple vendor detections suggests a high likelihood of ongoing or repeat use. Defenders should add the domain and its IP address to internal blocklists, monitor for future DNS or SSL certificate changes, and ensure that endpoint and web‑filtering solutions reference the VirusTotal detection count. Continuous observation of the associated ASN (AS16509) for similar Framer‑based deployments is advised, as is verification that users are educated about the official Coinbase login URLs to reduce credential‑theft risk.