web-coinbase-pro-us[.]framer[.]media

Analysis of web-coinbase-pro-us.framer.media shows a clear pattern of brand impersonation aimed at Coinbase users. The domain, registered through CSC Corporate Domains, Inc. on November 19, 2021, resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site was served over a Let’s Encrypt certificate (E7) and employed modern web technologies including Framer Sites, React, HSTS, and HTTP/3, suggesting the use of a legitimate‑looking front‑end framework. The page title returned by the server, "Coinbase - Buy & Sell Bitcoin, Ethereum, and more …," directly mirrors the official Coinbase branding, reinforcing the impersonation attempt.

VirusTotal scans recorded 16 detections out of 95 security vendors, and the domain appears on a single external blocklist, indicating that multiple security products have flagged the host as malicious. PhishDestroy also listed the domain as blocked, and the HTTP response code is 404, implying that the malicious content has been taken offline at the time of reporting. The observed scam type is classified as a crypto scam, consistent with the Coinbase brand targeting.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP 52.223.52.2 for any resurgence of malicious activity, and update detection signatures to include the observed certificate chain and technology stack. Incident response teams should also inform users of the fraudulent page title and advise against any credential entry on sites presenting similar titles. Continuous threat‑intel feeds should be consulted for any re‑registration attempts using similar sub‑domains or variations of the framer.media hosting service.