pro-coinbes-help[.]framer[.]media

Analysis of pro-coinbes-help.framer.media confirms it as a high-risk phishing domain targeting Coinbase Pro users. The domain, registered on February 21, 2026, through CSC Corporate Domains, Inc., resolves to IP 52.223.52.2 (AS16509, Amazon.com, Inc., US) and was hosted on Framer Sites infrastructure with React, HSTS, and HTTP/3 technologies detected. The page title, 'Coinbase Pro Login || Pro account Help,' explicitly indicates an attempt to impersonate Coinbase Pro's login interface, aligning with Google Safe Browsing's classification of social engineering content.

The domain appears on at least one security blocklist and was flagged by 12 of 93 security vendors on VirusTotal, though the exact detection context remains unverified. SSL certification was provided by Let's Encrypt (E7), a common choice for both legitimate and malicious sites. As of July 24, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline, though its prior activity and infrastructure warrant continued monitoring.

Defenders should treat this domain as confirmed malicious, block it at the network level, and review logs for prior connections from internal assets. The use of AWS nameservers (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net) and Amazon hosting infrastructure is consistent with phishing campaigns leveraging cloud providers for scalability and evasion. No additional brand impersonation or scam type details are available beyond the Coinbase Pro targeting indicated by the page title.