divace-coinbas-pros[.]framer[.]ai

Analysis of divace-coinbas-pros.framer.ai indicates that the site was deliberately crafted to impersonate Coinbase’s professional trading platform. The page title returned by the server, “Coinbase Pro Login: Just a Few Easy™®”, directly references the legitimate brand, confirming a brand‑impersonation motive. The domain was registered on 06 January 2018 through CSC Corporate Domains, Inc., and is hosted on Amazon Web Services (IP 52.223.52.2, ASN 16509, United States). The hosting environment shows the use of Framer Sites and a React front‑end, with HSTS and HTTP/3 enabled, and the TLS certificate is issued by Let’s Encrypt (certificate identifier E8). DNS resolution points to four AWS name servers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns).

The HTTP response is a 404 status, and the current operational state is marked as offline, matching the “taken offline” note in the intelligence feed. Security‑vendor scans on VirusTotal flagged the domain in 9 of 95 engines, and Google Safe Browsing categorises the site as social‑engineering. The domain appears on one additional blocklist and has been blocked by the PhishDestroy sinkhole, reinforcing the malicious intent. The listed scam type is “Crypto Scam”, suggesting that any credential capture would likely target cryptocurrency accounts.

Uncertainties remain regarding the exact phishing payload, the presence of credential‑stealing forms, and whether the site ever served a functional login page before being taken down. No visual or content analysis is available beyond the page title. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host or similar subdomains, and update endpoint detection rules with the observed SSL fingerprint and IP address.