coinbase-com-setup[.]framer[.]media

Analysis of coinbase-com-setup.framer.media indicates that the domain was created on 19 November 2021 and is hosted on Amazon Web Services (ASN 16509). DNS resolution points to IP 35.71.142.77, which is registered to the United States and belongs to the Amazon.com, Inc. network. The domain is served over HTTPS using a Let’s Encrypt certificate (E7) and enforces HSTS, while the underlying web stack includes Framer Sites, React, and HTTP/3. An HTTP request to the root URL returns a 404 status, suggesting that the malicious page is either removed or never existed at that endpoint.

The page title retrieved from historical records reads “Coinbase Pro Login - Buy and Sell Bitcoin, Ethereum, and more”, directly referencing the Coinbase brand and matching the declared crypto‑scam purpose. Registration was performed via CSC Corporate Domains, Inc., and the domain appears on a single security blocklist, currently PhishDestroy. VirusTotal scans have flagged the domain by seven of ninety‑five antivirus engines, providing additional corroboration of malicious intent. The infrastructure is presently offline, and no further content is reachable for direct inspection.

Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor the associated IP range for any re‑activation, and add the domain to internal watchlists. Because the site is already taken down, the immediate risk is limited to users who may have previously accessed the URL; forensic review of browser histories and credential stores is advised. No public threat‑intel feeds beyond the listed blocklist have been observed, and the exact phishing kit remains unidentified.