public-coinpro-learn[.]framer[.]website

Analysis of public-coinpro-learn.framer.website shows a high-confidence impersonation of Coinbase. The domain was registered on 19 Nov 2021 through CSC Corporate Domains, Inc. and resolves to 52.223.52.2, an Amazon Web Services host (AS16509, United States). The TLS certificate is issued by Let’s Encrypt (E7) and the site presents HSTS and HTTP/3 support, indicating a modern web stack. Front‑end fingerprints include Framer Sites and React, which are common in legitimate site builders but also frequently abused by threat actors. The page title returned by the server is “Official Site® | Coinbase Pro | Digital Asset Exchang”, directly referencing Coinbase’s brand.

VirusTotal reports that 13 of 95 scanned security engines flag the domain, reinforcing the suspicion. The domain appears on one external blocklist and has been taken offline, with the current HTTP response code 404. PhishDestroy has already added the host to its blocklist, confirming that it was engaged in a crypto‑scam campaign targeting Coinbase users. The open‑source intelligence does not reveal any additional payloads, credential‑harvesting forms, or redirects; the exact malicious content is therefore uncertain.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting of the same host name or IP, and update endpoint protections with the observed VT detections. Because the infrastructure is hosted on AWS, any future redeployment could inherit the same IP range, so AWS‑specific egress controls are advisable. Analysts should also watch for new subdomains under the same registrar that may reuse the same naming pattern, and consider adding the domain to internal threat intel feeds. The combination of brand impersonation, confirmed blocklist entry, and multiple vendor detections classifies the domain as an elevated‑risk crypto‑scam indicator.