conibse-prox[.]framer[.]website

The domain conibse-prox.framer.website was observed hosting a page titled "Coinbase Pro Login® | Secure™ Access Assets," indicating an attempt to impersonate Coinbase’s trading platform. Registration data shows the domain was created on November 19, 2021 and is listed under the registrar CSC Corporate Domains, Inc. The authoritative name servers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, and ns-792.awsdns, all typical of AWS DNS infrastructure. DNS resolution points to the IP address 35.71.142.77, which belongs to ASN 16509 operated by Amazon.com, Inc., and is geolocated to the United States. The web server presents an HTTPS certificate issued by Let’s Encrypt (certificate profile E7), confirming the use of a valid TLS certificate but offering no indication of legitimacy.

HTTP requests return a 404 status, suggesting the malicious page is no longer accessible; the domain’s current status is recorded as offline. Technical fingerprints reveal the presence of Framer Sites, React, HSTS, and HTTP/3, consistent with modern web‑application stacks but not indicative of any specific phishing kit. Threat intelligence indicates the site appears on a single blocklist, PhishDestroy, and 15 out of 95 security vendors on VirusTotal have flagged the domain as malicious, reinforcing the assessment of brand impersonation.

Given the elevated risk rating and the confirmed targeting of Coinbase, defensive operators should ensure that the domain and its resolved IP address are blocked at network perimeter and DNS filtering layers. Continuous monitoring of the associated AWS IP range for any future activity is advised, as the infrastructure could be repurposed for further cryptocurrency‑related campaigns. Organizations should also update internal security policies to flag any communications referencing the exact page title or similar Coinbase branding to mitigate user exposure to potential credential‑ harvesting attempts.