coinbase-pro-secure[.]framer[.]ai

The domain coinbase-pro-secure.framer.ai was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is presently taken offline, returning an HTTP 404 response with the page title "Site Not Found | Framer". Technical fingerprinting shows the site was hosted on Amazon Web Services (ASN16509) in the Netherlands, resolving to IP address 31.43.160.6. The certificate presented was issued by Let’s Encrypt (E8), and the service stack included Framer Sites, React, HSTS, and HTTP/3. A scan on VirusTotal recorded 15 detections out of 93 analyzing engines, indicating a moderate level of malicious confidence.

Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on a single security blocklist, where it has been actively blocked by PhishDestroy. The domain purpose is identified as a crypto scam impersonating the Coinbase brand, though the exact payload or credential‑stealing mechanism has not been captured. Evidence confirms the domain resolves to a legitimate AWS IP range, suggesting the attackers leveraged reputable cloud infrastructure to lend credibility.

No additional intelligence, such as phishing page screenshots or malware samples, is currently available. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP and name server set (ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org), and update endpoint protection signatures to incorporate the observed VirusTotal detections. Because the site is offline, active exploitation is unlikely, but the infrastructure could be repurposed for future campaigns; continuous vigilance on the AWS host and associated certificate is advised.