coin-en-help[.]framer[.]media

This domain, coin-en-help.framer.media, was created on 19 November 2021 and is presently taken offline. Registration records show CSC Corporate Domains, Inc. as the registrar. The authoritative name servers are ns-1267.awsdns-30.org, ns-535.awsdns-02.net, ns-1854.awsdns-39.co.uk and ns-97.awsdns-. The domain resolves to the Amazon Web Services IP 52.223.52.2, which belongs to AS16509 (Amazon.com, Inc.) and is located in the United States. TLS is provided by a Let’s Encrypt certificate issued to the E7 identifier, and the site advertises HSTS and HTTP/3 support.

A HTTP GET returns a 404 status code, indicating that the landing page is not available at the time of testing. The page title that was observed earlier reads “Coinbase Pro Login | Secure Access to Your Crypto Account*”, and the site has been classified as a crypto‑scam that impersonates Coinbase. VirusTotal reports 15 of 95 scanners flagging the domain, and PhishDestroy has added it to its blocklist. Google Safe Browsing also marks the domain for social‑engineering threats. Additional security tooling lists the domain on a single blocklist.

The observed technology stack includes Framer Sites and React, consistent with a quickly assembled impersonation kit. Evidence of the actual content is limited because the site is offline, so the precise phishing flow cannot be confirmed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation, and consider adding the IP address 52.223.52.2 to threat‑intel feeds. Ongoing observation of the registrar CSC Corporate Domains, Inc. for similar registrations is recommended.