home-coinbsepro[.]framer[.]ai

Analysis of the domain home-coinbsepro.framer.ai indicates it was actively impersonating Coinbase Pro, a digital asset exchange platform, as part of a cryptocurrency scam. The domain resolved to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc., on January 6, 2018, though its malicious use appears to have been recent. The site employed a Let's Encrypt SSL certificate (serial number E8), and technologies detected include Framer Sites, React, HTTP Strict Transport Security (HSTS), and HTTP/3, suggesting a modern, albeit fraudulent, web presence. The page title, 'Log-in | Coinbase Pro | Digital® Asset Exchange®,' directly mirrors the branding of the legitimate Coinbase Pro platform, reinforcing its intent to deceive users into believing they were accessing an official login portal.

Google Safe Browsing flagged the domain for social engineering, and it was blocked by at least one security vendor, PhishDestroy. The domain appeared on a single security blocklist at the time of assessment, and four out of ninety-five security vendors on VirusTotal flagged it as malicious. Nameservers associated with the domain include ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all of which are part of Amazon's DNS infrastructure. As of July 25, 2026, the domain has been taken offline, returning an HTTP 404 status code.

While the exact content of the site was not analyzed, the combination of its branding, page title, and detection by security vendors confirms its role in a cryptocurrency scam targeting Coinbase Pro users. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels.