coinbaselogin[.]framer[.]media

Analysis conducted on July 24, 2026 identifies coinbaselogin.framer.media as a confirmed Coinbase impersonation infrastructure. The domain was registered on November 19, 2021 through CSC Corporate Domains, Inc. and resolves to 35.71.142.77, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site presented the page title “Coinbase Pro Login: Safe and Fast Access to Your Account,” a classic indicator of brand impersonation aimed at cryptocurrency users. Technical fingerprinting shows the deployment of Framer Sites with a React front‑end, HTTP/3 support and HSTS enforcement, all served under a Let’s Encrypt certificate issued to E7. An HTTP 404 response was observed at the time of testing, and the domain has since been taken offline.

Reputation services flag the domain as malicious: Google Safe Browsing classifies it under social engineering, and VirusTotal recorded 11 detections out of 93 scanners. The domain appears on one public blocklist and is actively blocked by PhishDestroy. Nameserver configuration consists of four AWS‑managed servers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-...). The combination of the brand‑specific page title, the crypto‑related scam type, and the observed infrastructure points to a typical credential‑harvesting campaign targeting Coinbase customers.

Uncertainty remains regarding the exact payload delivered after the initial landing page, as no URL‑level content was captured before the site was withdrawn. No evidence of additional hosting, command‑and‑control, or exfiltration endpoints was discovered in the available data. Defenders should add the domain and its resolved IP to network‑level deny lists, enforce strict DNS filtering for any sub‑domains of framer.media that resolve to Amazon‑owned IP ranges, and monitor for similar page‑title patterns in future scans.