overview-coienbasepro-x-sso[.]framer[.]media

The domain overview-coienbasepro-x-sso.framer.media was first registered on 19 November 2021 through CSC Corporate Domains, Inc. Its authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net and ns-97.awsdns- (truncated). DNS resolution points to IP address 35.71.142.77, an Amazon.com, Inc. (AS16509) host located in the United States. The web server presents a Let's Encrypt certificate (issuer E7) and advertises modern security features including HTTP Strict Transport Security and HTTP/3, indicating it is hosted on a legitimate CDN platform. Automated scans retrieve a 404 response and the page title "Site Not Found | Framer," suggesting the site is presently offline or misconfigured.

Despite the inactive HTTP status, the domain has been flagged by multiple security services: VirusTotal reports 12 of 95 scanned vendors detecting malicious activity, and PhishDestroy lists the domain on its blocklist. It also appears on a single external blocklist, reinforcing the suspicion that the domain is being used for malicious purposes. The recorded scam type is a crypto‑related phishing campaign, consistent with the broader pattern of fraudulent sites leveraging Framer‑based templates to lure victims.

At present, no content has been captured that would reveal the specific phishing vector, landing page, or credential‑harvesting mechanisms, leaving the exact tactics uncertain. Defenders should continue to block the domain at network perimeters, update DNS filtering policies, and monitor for any re‑activation of the host. Incident response teams encountering traffic to this address should treat it as a high‑confidence indicator of a crypto phishing operation and isolate affected endpoints, while threat‑intel feeds should be refreshed to capture any future observations tied to the same IP range or certificate.