coinbassepro[.]framer[.]ai

The domain coinbassepro.framer.ai was registered on February 21, 2026 through CSC Corporate Domains, Inc. and resolves to the IPv4 address 31.43.161.6, which is hosted within Amazon’s AS16509 network in the Netherlands. The authoritative name servers are ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, among others, confirming that the domain is served from Amazon Web Services. A Let's Encrypt certificate (issuer E8) is active, and the site advertises modern security features such as HTTP Strict Transport Security and HTTP/3, indicating a properly configured TLS endpoint despite its malicious purpose. The web application stack includes Framer Sites and React, consistent with the hosting platform’s default offering.

Public threat intelligence flags the domain on a single security blocklist and records a Google Safe Browsing classification as social engineering. VirusTotal analysis shows 15 of 93 scanning engines flag the domain, providing additional corroboration of malicious intent. The page currently returns a 404 HTTP status with the title "Site Not Found | Framer," and the domain has been taken offline, as noted by the PhishDestroy blocklist. The combination of blocklist presence, Safe Browsing warning, and multiple vendor detections meets the criteria for a high‑risk generic phishing classification.

Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and consider adding the address to internal threat feeds. Continued observation of the registrar and name‑server records is advised, as the infrastructure could be re‑activated with new content. Organizations relying on Google Safe Browsing or VirusTotal alerts should ensure these feeds are enabled to capture future activity from this indicator.