pro-coinbase-learn[.]framer[.]ai

The domain pro-coinbase-learn.framer.ai was registered through CSC Corporate Domains, Inc. on January 06, 2018 and is currently taken offline. Its authoritative nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, indicating use of Amazon Route 53 DNS services. DNS resolution points to IP address 35.71.142.77, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated to the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier “E8”), and the HTTP response returned a 404 status code, suggesting the content is no longer reachable.

Detected web technologies include Framer Sites, React, HSTS, and HTTP/3, consistent with a modern static‑site hosting stack. Google Safe Browsing flags the domain for social engineering, and it appears on one public security blocklist, where PhishDestroy has listed it as malicious. VirusTotal analysis recorded 11 detections out of 95 scanning engines, reinforcing the malicious classification. The page title observed when the site was active was “Coinbase Pro Login® | Secure™ Access Assets,” directly impersonating Coinbase and indicating a crypto‑related scam.

While the site is offline, the combination of registrar data, hosting infrastructure, SSL usage, and multiple detection sources confirms a high‑risk credential‑stealing operation targeting Coinbase users. Defenders should block the domain and its associated IP at perimeter defenses, monitor for any re‑use of the same nameserver set or Amazon‑hosted IP ranges, and update email security filters to catch similar brand‑impersonation subjects. Threat intelligence feeds should continue to reference this indicator, and any future re‑registration of the domain should be treated as a repeat offender.