sso-coin-basse[.]framer[.]media

The domain sso-coin-basse.framer.media was registered on February 21, 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned IP address 52.223.52.2 (AS16509, United States). The site served a page titled “Coinbase Pro Login – Secure & Easy Access,” indicating an attempt to impersonate Coinbase Pro's authentication portal. Technical profiling shows the site was built on Framer Sites and React, and it employed modern transport security features including HTTP Strict Transport Security (HSTS) and HTTP/3. The TLS certificate was issued by Let’s Encrypt (E7), confirming the use of a free certificate authority. DNS resolution relied on the authoritative name servers ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, and ns-535.awsdns-02.net.

Google Safe Browsing classified the domain as a social‑engineering threat, and one security blocklist, PhishDestroy, has already taken the domain offline. VirusTotal analysis recorded 11 detections out of 93 scanned security vendors, reinforcing the malicious assessment. An HTTP request to the host returned a 404 status, consistent with the domain’s reported offline state. Evidence indicates the domain was actively used for credential‑harvesting against Coinbase Pro users, but the current offline status limits immediate threat surface.

Uncertainty remains regarding the full extent of victimization, the presence of additional infrastructure, and whether the site hosted other phishing pages before takedown. Defenders should add sso-coin-basse.framer.media to blocklists at network and endpoint layers, monitor DNS queries for the listed AWS name servers, and watch for any re‑registration of similar sub‑domains under the same registrar. Continuous observation of the hosting IP 52.223.52.2 for new malicious activity is advised, as attackers often repurpose cloud instances. Organizations using Coinbase Pro should reinforce user awareness of unexpected login prompts and encourage verification of URLs before credential entry.