learn-coinpro-base[.]framer[.]ai

The domain learn-coinpro-base.framer.ai was observed hosting a page titled “Coinbase Login – Buy and Sell Bitcoin, Ethereum,” explicitly targeting Coinbase users. The site was provisioned on Amazon Web Services (AS16509) and resolved to 52.223.52.2, an IP address located in the United States. DNS records use the AWS Route 53 name servers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, indicating standard cloud‑based hosting. The TLS certificate is issued by Let’s Encrypt (E8), providing HTTPS with HSTS and HTTP/3 support. Technical fingerprints show the site was built with Framer Sites and React, consistent with the observed “Framer Sites” tag.

The HTTP response returned a 404 status, and the domain is currently taken offline. Registration data shows the domain was created on 04 April 2023 through CSC Corporate Domains, Inc. The domain appears on one security blocklist and has been actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal scans reported eight of ninety‑three security vendors flagging the domain as malicious, reinforcing the suspicion of a crypto‑related scam.

The overall risk assessment is elevated due to the combination of brand impersonation, cloud hosting, and multiple independent detections. Defenders should add learn-coinpro-base.framer.ai to outbound and inbound blocklists, monitor AWS‑hosted subdomains for re‑registration, and update URL‑filtering rules to catch similar “framer.ai” patterns. Incident response teams should treat any login attempts to this URL as compromised and advise users to avoid submitting credentials. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure.