coinbase-prologin[.]framer[.]media

Analysis of coinbase-prologin.framer.media shows multiple indicators of malicious activity targeting the Coinbase brand. The domain was registered on November 19, 2021 through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) in the United States. The hosting environment is identified as Amazon Web Services, and the domain uses AWS Route 53 nameservers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-). The site presents a page title of "Coinbase Pro Login® | Secure™ Access Assets," directly referencing the Coinbase brand and indicating a crypto‑related impersonation. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has actively blocked it, confirming its use in credential‑harvesting attempts.

VirusTotal reports that 11 of 93 security vendors have flagged the domain, providing a modest but notable detection ratio that aligns with other threat‑intel sources. The SSL certificate is issued by Let’s Encrypt (E7), offering valid encryption but not mitigating the deceptive intent. HTTP probing returns a 404 status, and the domain is currently listed as offline, suggesting the phishing page may have been taken down or is being rotated. Technologies detected on the site include Framer Sites, React, HSTS, and HTTP/3, which are common in modern phishing kits designed to mimic legitimate login portals.

The domain appears on at least one security blocklist, reinforcing its classification as a crypto scam. While the exact content of the page cannot be verified due to the 404 response, the combination of brand impersonation, malicious detection counts, and hosting on a reputable cloud provider is consistent with a high‑risk credential‑stealing operation. Defenders should continue to block the domain at network perimeters, monitor DNS queries for similar framer.media subdomains, and incorporate the domain into brand‑monitoring feeds.