pros-coinbasee-cdn[.]framer[.]ai

The domain pros-coinbasee-cdn.framer.ai is flagged as a brand‑impersonation site targeting Coinbase, with an elevated risk rating. Registration data shows the domain was created on January 06, 2018 and is registered through CSC Corporate Domains, Inc. DNS resolution points to 52.223.52.2, an Amazon Web Services host (AS16509, United States). The hosting environment reports the use of Framer Sites and React, with HTTP Strict Transport Security (HSTS) and HTTP/3 enabled. TLS is provided by a Let’s Encrypt certificate (issuer “E8”), indicating a valid HTTPS endpoint at the time of observation.

When accessed, the site returns HTTP 404 and the page title “Site Not Found | Framer”, suggesting the content has been removed or taken offline. VirusTotal analysis recorded 10 detections out of 95 security vendors, and the domain appears on one public blocklist, currently blocked by PhishDestroy. The infrastructure aligns with a crypto‑scam profile, leveraging the reputable Coinbase brand to lure victims.

While the site is presently offline, the underlying DNS and hosting configuration remain active, meaning the domain could be re‑used for future campaigns. Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor the associated IP address for any new services. Additional vigilance is advised for any outbound traffic to the AWS IP range that may be repurposed for malicious payload delivery.