coinbaseweb-pro[.]framer[.]ai

The domain coinbaseweb-pro.framer.ai was registered on April 04, 2023 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77, which is advertised as part of ASN 16509 (Amazon.com, Inc.) located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and advertised HSTS and HTTP/3 support. Infrastructure fingerprints show the use of Framer Sites and a React front‑end, consistent with a low‑cost website‑building kit. The authoritative nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming reliance on AWS DNS services. A page title retrieved from the domain—"Coinbase Pro Login | Trade, Send & Receive Crypto Securely"—directly references Coinbase’s professional trading platform, indicating a brand‑impersonation attempt aimed at cryptocurrency users.

The associated scam type is listed as a crypto scam. Google Safe Browsing classifies the domain as social engineering, and VirusTotal reports 13 of 93 scanning engines flagging the host, reinforcing the malicious assessment. The domain appears on one external security blocklist and has been explicitly listed by the PhishDestroy mitigation service. Current HTTP probing returns a 404 status, and the domain is marked offline, meaning the malicious landing page is no longer reachable.

Because the content cannot be examined, the exact phishing mechanics (form fields, credential capture, redirection) remain unknown. Nevertheless, the observed metadata—brand‑specific title, crypto‑focused naming, Amazon hosting, and detection signatures—strongly indicate a high‑risk brand‑impersonation campaign targeting Coinbase customers. Defenders should immediately block coinbaseweb-pro.framer.ai at perimeter firewalls and DNS filters, add the associated IP 35.71.142.