access-coinbse-sin[.]framer[.]media

access-coinbse-sin.framer.media was observed hosting a page titled “Sign In | Coinbase”. The domain is registered through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The site employed a Let’s Encrypt certificate (E7) and advertised HSTS and HTTP/3 support, while the underlying stack was identified as Framer Sites running React. Google Safe Browsing has classified the domain as a social‑engineering threat, and PhishDestroy has added it to its blocklist; it also appears on a single additional security blocklist.

VirusTotal analysis recorded four positive detections out of ninety‑three scanners. The HTTP response returned a 404 status, and the domain has since been taken offline. The page title and the declared “Crypto Scam” tag indicate an attempt to impersonate the Coinbase brand, targeting users with credential‑harvesting or crypto‑related fraud. Evidence of the impersonation is limited to the page title and the brand target field; no further content was captured before the takedown, so the exact phishing workflow remains unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for any re‑use, and add the domain to internal threat‑intel feeds. Because the infrastructure relies on a shared AWS name‑server set (ns‑97.awsdns‑12.com, ns‑1854.awsdns‑39.co.uk, ns‑535.awsdns‑02.net, ns‑1...), any future sub‑domains created under the same registrar may inherit similar characteristics and should be scrutinized. Ongoing vigilance is advised, especially for users receiving unsolicited Coinbase‑related login prompts, and any observed traffic to this host should be logged and investigated.