eng-coinbasepro-secure[.]framer[.]ai

The domain eng-coinbasepro-secure.framer.ai was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is hosted on Amazon’s infrastructure (AS16509) in the United States, resolving to IP address 52.223.52.2. DNS resolution uses the authoritative name servers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming the use of Amazon Route 53. The site presented a page title of "Coinbase Pro | Official Site | Login," indicating an attempt to impersonate the Coinbase brand, specifically its professional trading platform. HTTPS was served by a Let’s Encrypt certificate (E8), and the server advertised modern security controls such as HSTS and HTTP/3, while the front‑end stack was identified as Framer Sites running React.

An HTTP request returned a 404 status, suggesting that the malicious landing page is no longer actively serving content; the domain is currently marked as taken offline. Threat intelligence feeds have recorded the domain on one security blocklist and it is blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reported 15 detections out of 95 scanned vendors, reinforcing the malicious profile.

The observed characteristics align with a crypto‑scam campaign that seeks to harvest credentials from users believing they are accessing Coinbase Pro. Defenders should continue to block the domain at perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any resurgence of traffic from the associated IP address or similar sub‑domains hosted on the same AWS account. Incident response teams should also consider searching internal logs for recent connections to this domain or its IP, especially from users who access cryptocurrency services, and enforce multi‑factor authentication for Coinbase accounts to mitigate credential reuse.