web-coinbasepro-eng-us[.]framer[.]media

The domain web-coinbasepro-eng-us.framer.media was registered on November 19, 2021 through CSC Corporate Domains, Inc. It resolves to the IPv4 address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-?. The site presented a TLS certificate issued by Let’s Encrypt (E7) and advertised modern web stacks including Framer Sites, React, HSTS, and HTTP/3. The HTTP response returned a 404 status code, and the service has been taken offline at the time of this analysis.

VirusTotal scans recorded five detections out of ninety‑three security vendors, and the domain appears on a single external blocklist, where it is listed as blocked by PhishDestroy. The page title retrieved prior to takedown was "Coinbase Pro | Digital® Asset Exchange®," indicating a direct brand impersonation of Coinbase’s professional trading platform. The evidence points to a crypto‑related impersonation campaign that leverages a legitimate content‑delivery platform (Framer) to host a malicious page, likely intended to harvest credentials or redirect victims to fraudulent cryptocurrency services.

Defenders should immediately add the domain and its resolving IP address to network‑level deny lists, enforce DNS‑level blocking, and monitor for any resurgence of the same infrastructure under alternative subdomains. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any changes in payload or hosting. Because the site is currently offline, threat actors may be preparing a new iteration; therefore, security teams should also watch for similar naming patterns (e.g., "coinbasepro" combined with framer.media) and update detection rules accordingly.