my-coinbsecom[.]framer[.]ai

Analysis of the domain my-coinbsecom.framer.ai, observed on July 24 2026, indicates a brand‑impersonation campaign targeting Coinbase users. The site resolves to the Amazon‑owned IP address 52.223.52.2, located in the United States and announced by ASN 16509 (Amazon.com, Inc.). The hosting provider is Amazon Web Services, which aligns with the observed nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and is protected by a Let’s Encrypt certificate (issuer E8) that supports HSTS and HTTP/3. The page title returned by the server is “Coinbase.com - Sign in”, matching the advertised brand and confirming the intent to mimic Coinbase’s login portal.

The HTTP response is a 404 status, and the site is currently taken offline, as indicated by the blocklist entry and the fact that PhishDestroy has already listed the domain. VirusTotal scans show that ten of ninety‑five security engines flagged the host, reinforcing the suspicion of malicious activity. The observed technology stack includes Framer Sites and React, consistent with a quickly assembled phishing landing page. The campaign is classified as a crypto‑scam, suggesting attempts to harvest credentials or redirect victims to fraudulent cryptocurrency transactions.

While the domain’s content cannot be inspected directly because the site is offline, the combination of brand‑specific page title, malicious certificate usage, and detection by multiple vendors provides strong evidence of a credential‑harvesting operation. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the same IP or nameserver set, and add the host to internal phishing‑prevention lists. Additional scrutiny of related subdomains under the same registrar or AWS account may reveal further infrastructure used by the threat actor.