set-coinbase--pro-us[.]framer[.]media

Analysis of the domain set-coinbase--pro-us.framer.media shows a confirmed brand‑impersonation campaign targeting Coinbase users. The domain was registered on 19 Nov 2021 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services, as indicated by the four AWS name servers (ns-535.awsdns-02.net, ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-97.awsdns-). DNS resolution points to IP 35.71.142.77, which belongs to AS16509 Amazon.com, Inc. in the United States. An active TLS certificate issued by Let’s Encrypt (E7) secures the site, and the service advertises modern web stack components including Framer Sites, React, HSTS and HTTP/3.

The HTTP response is a 404 status with the page title "Site Not Found | Framer," confirming that the content is currently unavailable. Threat intelligence flags the domain on a single security blocklist and it is listed by PhishDestroy. A VirusTotal scan recorded 14 of 95 security vendors marking the domain as malicious, reinforcing the malicious classification. The campaign is labeled a crypto scam and explicitly impersonates the Coinbase brand.

The domain’s current status is offline, and no additional payload or credential‑collection page has been observed beyond the title. Defenders should add the domain and its IP address to local deny lists, monitor the associated name servers for future changes, and ensure TLS inspection is active to detect any re‑appearance of malicious content. Continuous enrichment of threat feeds with these indicators is recommended to maintain coverage against potential re‑use of the infrastructure.