learn-coinbesapro-logn[.]framer[.]media

Analysis of the domain learn-coinbesapro-logn.framer.media confirms its classification as a cryptocurrency-themed phishing site, now offline. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and hosted on Amazon Web Services (AS16509) at IP address 35.71.142.77, located in the United States. Infrastructure analysis reveals the use of Framer Sites and React, with HTTP/3 and HSTS enabled, indicating a modern web stack commonly exploited for phishing campaigns. As of July 25, 2026, the domain resolves to a 404 error page with the title 'Site Not Found | Framer,' suggesting it was either taken down by the hosting provider or abandoned by the threat actor. Despite its offline status, the domain remains flagged by 12 of 93 security vendors on VirusTotal, and it appears on at least one blocklist (PhishDestroy).

The SSL certificate, issued by Let's Encrypt (serial number E7), does not provide additional indicators of compromise but confirms encrypted communication was in place during its active period. The domain name itself, incorporating terms like 'coin' and 'pro,' strongly suggests a focus on cryptocurrency users, though no specific brand impersonation (e.g., Coinbase, Binance) is confirmed from the available data. The use of Framer, a legitimate website builder, aligns with observed trends where threat actors leverage free or low-cost hosting services to rapidly deploy phishing pages. The absence of further brand-specific indicators or page content analysis limits definitive attribution to a particular scam subtype (e.g., wallet drainer, fake exchange). Defenders should treat this domain as part of a broader cryptocurrency phishing campaign.

The combination of AWS hosting, Framer infrastructure, and Let's Encrypt certificates is consistent with low-cost, high-volume phishing operations. While the domain is currently offline, security teams should monitor for re-registration or reuse of the same infrastructure (e.g.