help-coinbase-secure[.]framer[.]media

Analysis of help-coinbase-secure.framer.media shows a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered through CSC Corporate Domains, Inc. and created on 19 November 2021. It resolves to the Amazon Web Services address 35.71.142.77, located in the United States and advertised under ASN 16509 (Amazon.com, Inc.). The hosting environment uses Let’s Encrypt certificate issued to the domain, with HSTS and HTTP/3 enabled, and the site stack is identified as Framer Sites running React.

The page title returned by the server is “Coinbase – Sign in”, directly mirroring the legitimate brand’s login page, which aligns with the listed scam type “Crypto Scam”. Google Safe Browsing has flagged the domain for social engineering, and 16 of 93 security vendors on VirusTotal have generated detections. PhishDestroy has taken the site offline, and the domain currently returns an HTTP 404 response. It appears on a single external blocklist, and the domain is listed in one additional security blocklist.

The combination of brand‑specific page title, the use of a reputable SSL certificate, and the presence of modern web technologies suggests a deliberately crafted impersonation site designed to harvest Coinbase credentials. Because the site is already offline, immediate containment actions are limited to ensuring that any cached copies or redirects are removed from corporate web filters. Defensive teams should add the domain and its associated IP address to URL filtering and indicator‑of‑compromise (IOC) lists, monitor for any resurgence of similar Framer‑based impersonation domains, and enforce multi‑factor authentication for Coinbase accounts to mitigate credential reuse. Continuous observation of the registrar CSC Corporate Domains, Inc. and the AWS name‑server set (ns‑1267.awsdns‑30.org, ns‑1854.awsdns‑39.co.uk, ns‑535.awsdns‑02.net, ns‑97.awsdns‑…) is recommended to detect future registrations that may reuse the same infrastructure.