coinss-helppro[.]framer[.]ai

This domain, coinss-helppro.framer.ai, was registered on 06 January 2018 through CSC Corporate Domains, Inc. It resolves to the Amazon Web Services address 52.223.52.2, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, all typical of AWS‑hosted sites. The site presented the page title “Coinbase Pro | Digital Asset Exchange®”, indicating a targeted impersonation of the Coinbase brand. TLS is provided by a Let’s Encrypt certificate (issuer E8), and the server announced HSTS and HTTP/3, confirming modern web stack usage.

An HTTP request returned a 404 status, suggesting the content is no longer publicly reachable; the infrastructure has been taken offline as reported. Security‑vendor observations show mixed detection: Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded 12 detections out of 95 scanners. Google Safe Browsing classifies the URL as social‑engineering, and PhishDestroy has listed the domain on its blocklist, which also appears on one additional security blocklist. The underlying technology stack was identified as Framer Sites running React.

Evidence confirms a high‑risk brand‑impersonation campaign aimed at Coinbase users, but the exact payload or credential‑harvesting pages have not been captured. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for any re‑hosting of the same hostnames or certificate fingerprints, and educate users that any request to a Framer‑hosted site claiming to be Coinbase Pro is untrusted. Ongoing vigilance is recommended because the infrastructure could be resurrected on a different AWS endpoint.