secure-pros-base[.]framer[.]ai

Analysis of secure-pros-base.framer.ai, observed on July 24, 2026, confirms a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to the Amazon Web Services IP address 35.71.142.77, which belongs to AS16509 (Amazon.com, Inc.) and is hosted in the United States. DNS configuration lists four AWS Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The registrar is CSC Corporate Domains, Inc., and the domain was created on January 06, 2018. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) is present, and the site advertises HSTS and HTTP/3 support, indicating modern web‑server configuration.

Technology fingerprints show the use of Framer Sites and the React JavaScript framework, consistent with a quickly assembled clone site. The page title returned by the server is "Login | Coinbase.com®", matching the brand target. Google Safe Browsing flags the site for social‑engineering content, and VirusTotal records 11 detections out of 95 scanned security vendors, reinforcing the malicious classification. The domain appears on one external security blocklist and is actively blocked by PhishDestroy.

HTTP response code 404 suggests the site is currently offline, which aligns with the reported status of "taken offline". While the page content has not been captured, the combination of brand‑specific title, fraudulent SSL, and detection data indicates a credential‑harvesting operation aimed at Coinbase users. Defenders should add the domain and its IPv4 address to network‑level blocklists, monitor for similarly structured subdomains under framer.ai, and enforce outbound filtering for traffic to unknown AWS‑hosted sites. Continuous re‑resolution checks are advised, as the infrastructure could be re‑activated by the threat actor.