sso-coinbase-pro[.]framer[.]media

On July 23 2026 analysts observed that the domain sso-coinbase-pro.framer.media is currently offline but retains a set of indicators consistent with a brand-impersonation campaign aimed at Coinbase users. The site returned HTTP 404, and its page title was captured as “Coinbase Pro Login | Secure Access to Your Account”, suggesting an attempt to lure victims into a credential-harvesting flow. The domain was registered on 19 November 2021 through CSC Corporate Domains, Inc., and is hosted on Amazon’s AS16509 infrastructure, resolving to 52.223.52.2 in the United States. SSL was provided by Let’s Encrypt (certificate E7), and network fingerprints show the presence of Framer Sites, React, HSTS and HTTP/3, all typical of modern phishing kits.

VirusTotal analysis recorded 12 detections out of 95 scanning engines, and the domain appears on a single blocklist, PhishDestroy, which has already taken it offline. Nameservers are hosted on AWS (ns-97.awsdns-12.com, ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-). The intelligence confirms the campaign is classified as a crypto-scam, directly impersonating Coinbase’s Pro service.

Uncertainty remains regarding the active payload, e‑mail distribution vectors, and whether additional infrastructure shares the same IP range. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same host or similar sub-domains, and enforce multi-factor authentication for Coinbase accounts. Threat‑intel feeds should be updated with the observed indicators, and any inbound traffic to the listed IP or nameservers should be logged for further forensic correlation.