secure-cnbase-pros[.]framer[.]media

Analysis of the domain secure-cnbase-pros.framer.media indicates it was actively impersonating Coinbase Pro, a cryptocurrency exchange platform, as of July 23, 2026. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and resolved to the IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious domains. At the time of assessment, the domain returned an HTTP 404 status, suggesting it had been taken offline or its content removed. The page title, 'Coinbase Pro Login: Complete Guide for Secure Access,' explicitly aligns with the scam type classified as a crypto scam, targeting users of the Coinbase platform.

Detection data shows the domain was flagged by 14 of 93 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed. Google Safe Browsing categorized the domain under social engineering, further corroborating its malicious intent. The domain appeared on one security blocklist and was blocked by PhishDestroy, though additional blocklist participation is not confirmed. Infrastructure analysis reveals the domain used AWS nameservers, a common hosting choice that does not inherently indicate malicious activity but is frequently leveraged in phishing campaigns due to its scalability and availability. The domain's registration through a corporate registrar does not provide conclusive evidence of legitimacy or malice, as such registrars are used by both legitimate entities and threat actors.

Defenders should treat this domain as high-risk due to its confirmed impersonation of Coinbase, detection by multiple security vendors, and classification as a crypto scam. Network-level blocking is recommended for organizations handling cryptocurrency or financial data.