start-coinbase-web[.]framer[.]ai

Analysis of start-coinbase-web.framer.ai shows a domain that has been deliberately crafted to impersonate Coinbase, as indicated by the page title "Regain access to your account | Coinbase". The domain is registered through CSC Corporate Domains, Inc. and was created on January 06, 2018. Infrastructure inspection reveals that the site resolves to the IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The server presents a Let's Encrypt certificate (E8) and enforces HSTS, while also supporting HTTP/3.

Detected technologies include Framer Sites, React, and standard web security headers. An HTTP request returns a 404 status, and the site is currently taken offline. Threat intelligence flags the domain as a crypto‑related scam and places it on the PhishDestroy blocklist, where it appears as a single entry. VirusTotal analysis shows that 11 out of 95 scanning engines have flagged the domain, providing additional confidence in its malicious nature.

Nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. While the domain is offline, its historical presence and the existing detections suggest it has been used for brand impersonation against Coinbase users. Defenders should ensure the domain is blocked at network perimeter and DNS layers, update email security filters to catch references to the page title, and monitor the associated IP range for any re‑activation. Continuous observation of the registrar and nameserver changes is advised, as well as periodic re‑scans with VirusTotal or similar services to capture any new malicious activity.