sso-coinbaseee-comn[.]framer[.]website

The domain sso-coinbaseee-comn.framer.website was registered on 19 November 2021 through CSC Corporate Domains, Inc. It resolves to the Amazon‑owned IP address 52.223.52.2, which is announced by ASN 16509 in the United States. The hosting provider is Amazon.com, Inc., and the site is served over HTTPS using a Let’s Encrypt certificate issued to the E7 validation authority. DNS resolution uses the Amazon Route 53 nameservers ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com and ns-792.awsdns. Fingerprinting shows the site was built with Framer Sites and React, and it advertised HSTS and HTTP/3 support. The HTTP response for the root URL returned a 404 status code, and the page title reported by the server was “Log‑in | Coinbase Pro | Digital* Asset Exchange®”.

VirusTotal scanned the domain and recorded seven detections out of ninety‑five security vendors. The domain appears on a single blocklist, PhishDestroy. The overall profile matches a brand‑impersonation campaign targeting Coinbase users, classified as a crypto‑related scam. As of the report date, 24 July 2026, the domain is offline and no active content can be retrieved.

Evidence is limited to registration metadata, DNS configuration, SSL certificate details, technology stack, HTTP status, and the historical detection counts. Uncertainty remains about the original phishing kit, the precise deployment timeline, and whether additional infrastructure shares the same hosting pattern. Defenders should continue to block the domain at network and DNS layers, monitor for re‑registration or similarly structured sub‑domains, and add the observed indicators—IP 52.223.52.2, the Let’s Encrypt certificate, and the Framer Sites/React fingerprint—to threat‑intel feeds. Ongoing vigilance is recommended for users receiving unsolicited Coinbase‑related login prompts, even though this particular instance appears to be taken down.