coinbasepro[.]framer[.]media

The domain coinbasepro.framer.media was registered on 21 February 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77, which is assigned to AS16509 (Amazon.com, Inc.) in the United States. The site returns an HTTP 404 status and the server‑provided page title is “Site Not Found | Framer”. TLS is supplied by a Let’s Encrypt certificate issued by the E7 intermediate, and the server advertises HSTS and HTTP/3. Fingerprinting indicates the use of Framer Sites and a React front‑end, consistent with a generic site‑building platform rather than authentic Coinbase infrastructure.

The domain appears on a single public security blocklist and is listed by the PhishDestroy feed. VirusTotal analysis records nine of ninety‑three scanners flagging the domain as malicious, reinforcing the suspicion that it is being used for illicit activity. Intelligence tags the site as a “Crypto Scam” and explicitly notes that it impersonates Coinbase, implying that any credential‑stealing or fund‑diversion operation would target users of the Coinbase exchange.

Because the domain is currently offline and serves only a 404 response, no page content, login forms, or redirect behavior can be examined. Consequently, the specific payload, data‑capture mechanisms, or victim interaction flow remain unknown, and Safe Browsing or Open Threat Exchange entries cannot be confirmed at this time.

Defenders should add coinbasepro.framer.media to URL filtering and DNS block lists, monitor the associated IP 35.71.142.77 for any reactivation of malicious services, and consider elevating alerts for outbound connections to that address. Given that the hosting provider is a reputable CDN, the infrastructure could be repurposed for future campaigns; continuous re‑scanning of the host and periodic review of its TLS certificate are advised.