learn-coinbasepro[.]framer[.]ai

The domain learn-coinbasepro.framer.ai is currently offline and returns an HTTP 404 status, indicating that the malicious front‑end has been taken down. The site was blocked by PhishDestroy and flagged by Google Safe Browsing for social engineering, providing a clear indication of abuse. VirusTotal records show eight of ninety‑five scanning engines labeling the domain as malicious, reinforcing the suspicion. Infrastructure analysis reveals the domain resolves to IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

The SSL certificate is issued by Let’s Encrypt with an E8 trust score, a common choice for short‑lived fraudulent sites. Registration data indicates the domain was created on January 06, 2018 and is registered through CSC Corporate Domains, Inc., using four Amazon Route 53 nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). Technical fingerprinting shows the site employed Framer Sites, React, HSTS, and HTTP/3, consistent with a modern web‑app framework. The page title captured during analysis reads "Log In | Coinbase Pro," and the threat intelligence tags the campaign as a crypto‑related scam impersonating Coinbase.

The domain appears on one security blocklist, confirming that at least one external repository has added it to a deny list. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP range for any re‑use, and update detection signatures to include the observed page title and TLS fingerprint. Incident response teams should also advise users that any credential requests originating from this URL are illegitimate and that the domain is not a legitimate Coinbase service.