pro--coinsbasse[.]framer[.]ai

The domain pro--coinsbasse.framer.ai was identified as a brand‑impersonation infrastructure targeting Coinbase customers. The site presents a page titled “Coinbase Pro Login | Secure Access to Your Crypto Trading Account,” indicating a direct attempt to harvest credentials for the Coinbase Pro service. Technical analysis shows the site is built on the Framer Sites platform and uses a React front‑end, with HSTS and HTTP/3 enabled, suggesting a modern web stack designed to appear legitimate. DNS resolution points to four Amazon Route 53 nameservers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns) and resolves to the IP address 52.223.52.2, which belongs to AS16509 owned by Amazon.com, Inc., located in the United States.

An SSL certificate issued by Let’s Encrypt (certificate identifier “E8”) was observed, providing a valid TLS handshake but offering no assurance of authenticity. HTTP requests return a 404 status code, and the domain is currently listed as offline, having been taken down or otherwise rendered inaccessible. The domain was created on 06 January 2018 and is registered through CSC Corporate Domains, Inc., a registrar commonly associated with bulk registrations. Threat intelligence feeds have flagged the domain on at least one security blocklist, and VirusTotal analysis recorded 15 detections out of 95 scanning engines, reinforcing the malicious classification.

The site is blocked by the PhishDestroy feed, indicating that at least one anti‑phishing consortium has taken remediation action. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any resurgence of the subdomain pattern under framer.ai, and consider adding the associated IP range to deny lists. Ongoing surveillance of related Framer‑based phishing campaigns is advised, as the platform’s ease of deployment may enable rapid replication of similar Coinbase‑focused impersonation attempts.