new-pro-coinbse[.]framer[.]website

This domain, new-pro-coinbse.framer.website, was observed hosting a credential‑harvesting page that used the title “Coinbase Pro Login – Secure Account Access” and claimed to target Coinbase users. The site was registered on 19 November 2021 through CSC Corporate Domains, Inc., and its authoritative nameservers are ns‑1243.awsdns‑27.org, ns‑1818.awsdns‑35.co.uk, ns‑336.awsdns‑42.com, and ns‑792.awsdns. DNS resolution pointed to 52.223.52.2, an address owned by Amazon.com, Inc. (ASN 16509) located in the United States. The web server responded with HTTP 404, indicating that the malicious landing page is no longer served; the infrastructure has since been taken offline.

HTTPS was provided by a Let’s Encrypt certificate (issuer E7), and the site advertised HSTS and HTTP/3 support, consistent with the Framer Sites and React stack detected by fingerprinting tools. VirusTotal recorded 15 detections out of 93 scanners, and the domain appears on a single external security blocklist. PhishDestroy has also listed the domain as blocked. The overall threat profile aligns with a crypto‑scam impersonation of Coinbase, leveraging a convincing page title to lure victims.

Defenders should continue to monitor the IP address 52.223.52.2 for any re‑use, add the domain and its IP to internal blocklists, and update URL filtering rules to include the full host name. Since the content is currently unavailable, retrospective analysis of HTTP requests captured before takedown may provide additional indicators such as unique request parameters or payloads. Organizations should educate users about the risk of unsolicited login prompts referencing Coinbase Pro, and enforce multi‑factor authentication to reduce the impact of credential compromise.