coinbaseprologen[.]framer[.]website

The domain coinbaseprologen.framer.website was observed hosting a page titled “Getting started with |Coinbase Pro Login”. The page title directly references Coinbase Pro, indicating a brand‑impersonation attempt aimed at Coinbase users. The site was built on the Framer Sites platform and serves content through a React front‑end, with security headers HSTS and HTTP/3 enabled. Registration data shows the domain was created on 19 Nov 2021 and is registered via CSC Corporate Domains, Inc., using Amazon Route 53 name servers (ns‑1243.awsdns‑27.org, ns‑1818.awsdns‑35.co.uk, ns‑336.awsdns‑42.com, ns‑792.awsdns). DNS resolution points to 52.223.52.2, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site presented a valid TLS certificate issued by Let’s Encrypt (E7) but returned HTTP 404 at the time of collection, and the overall service has been taken offline.

Threat intelligence indicates the domain is listed on a single blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded 13 detections out of 95 scanned security vendors, reinforcing the malicious classification. The reported scam type is “Crypto Scam”, consistent with the Coinbase brand impersonation. No further evidence such as payload samples, credential‑stealing scripts, or command‑and‑control infrastructure has been disclosed, leaving the exact malicious functionality unconfirmed. Defenders should continue to treat the domain as hostile.

Network‑level controls should block DNS resolution to the listed IP address and the full domain name, and web‑filtering solutions should enforce the blocklist entry from PhishDestroy. Email gateways should flag any messages referencing “Coinbase Pro Login” or containing URLs that resolve to the framer.website sub‑domain. Because the site employs a legitimate TLS certificate, reliance on certificate validation alone is insufficient; correlation with the known page title and registration details is required.