portal-coinpro[.]framer[.]ai

Analysis of portal-coinpro.framer.ai indicates that the site has been taken offline following detection by the PhishDestroy blocklist. The domain was originally registered on 2018-01-06 through CSC Corporate Domains, Inc., and resolves to the Amazon Web Services address 35.71.142.77 (ASN 16509, United States). Hosting on AWS is consistent with the observed nameserver set (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The web server presents an HTTPS certificate issued by Let’s Encrypt (certificate identifier E8) and enforces HSTS, while supporting HTTP/3. Front‑end fingerprints reveal the use of Framer Sites and the React JavaScript library, which are typical of modern website builders but do not provide any legitimate branding for the targeted organization.

The page title returned from the HTTP request is “Coinbase Pro Login® | Sign‑in Secure Access Assets”, directly referencing Coinbase’s professional trading platform. This title, combined with the classification “Crypto Scam” in the intelligence feed, strongly suggests a brand‑impersonation campaign aimed at harvesting credentials or funds from Coinbase users. VirusTotal has recorded nine detections out of ninety‑five scanners, confirming that multiple security vendors have flagged the domain as malicious. The domain appears on at least one public phishing blocklist, and the PhishDestroy entry explicitly marks it as offline. Remaining uncertainties include the exact content that was served before the takedown, as the current HTTP status is 404 and no visual capture is available.

It is also unclear whether any malicious payloads, credential‑stealing forms, or redirection mechanisms were active. No evidence of additional infrastructure, such as command‑and‑control servers or malware distribution points, has been identified in the available data.