coen-en-base-webs[.]framer[.]media

Analysis of coen-en-base-webs.framer.media indicates a confirmed brand‑impersonation operation targeting Coinbase users. The domain, created on 19 November 2021 and registered through CSC Corporate Domains, Inc., resolves to IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Infrastructure evidence shows the site is served over HTTPS using a Let’s Encrypt certificate (issuer E7) and employs modern web stacks including Framer Sites, React, HSTS, and HTTP/3. The authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-.

The HTTP response currently returns a 404 status, and the site is listed as offline. Threat intelligence flags the domain on one security blocklist and it is actively blocked by PhishDestroy. Google Safe Browsing categorises the URL as social‑engineering, and VirusTotal records eight detections out of ninety‑three scanners, reinforcing the malicious assessment.

The page title captured from prior crawls – “Coinbase Pro Login – Secure Access to Advanced Crypto Trading” – demonstrates a clear attempt to mimic Coinbase’s credential portal, aligning with the identified crypto‑scam classification. Defenders should add the domain and its associated IP address to network‑level deny lists, ensure endpoint URL filtering solutions reference the current blocklist entries, and monitor the IP range for any re‑hosting activity. Continuous re‑scanning of the domain is advised in case it becomes active again, and security teams should update detection signatures to include the observed TLS certificate profile and the specific Framer‑based hosting pattern.