access-coinbasehelp[.]framer[.]wiki

Analysis as of July 23 2026 shows that the domain access-coinbasehelp.framer.wiki was registered on 19 November 2021 through CSC Corporate Domains, Inc. The site resolves to the Amazon‑hosted address 35.71.142.77 (AS16509, United States). The TLS certificate is a Let’s Encrypt E8 certificate, indicating use of automated certificate issuance. Service banners reveal the presence of Framer Sites, React, HTTP/3 and HSTS, consistent with a modern static‑site generation platform rather than a legitimate Coinbase infrastructure. The HTTP response currently returns 404, and the domain is listed as offline in the threat feed.

Google Safe Browsing classifies the site as a social‑engineering vector, and one external blocklist has already added the host. VirusTotal scans show that 15 of 95 security vendors have flagged the domain, reflecting consensus that the host is malicious. The page title observed in historic crawls – “Log In | Coinbase pro login®: | Sign In to Your Account - Log In@” – directly references Coinbase, confirming a brand‑impersonation intent. The intelligence tags the activity as a crypto‑scam, aligning with the Coinbase brand target.

The domain is also blocked by the PhishDestroy sinkhole, and the four AWS name servers (ns-1185.awsdns-20.org, ns-1827.awsdns-36.co.uk, ns-423.awsdns-52.com, ns-772.awsdns…) resolve the zone. Defenders should immediately add access-coinbasehelp.framer.wiki to URL filtering and DNS block lists, monitor the associated IP range and ASN for new child domains, and enforce strict outbound filtering for any traffic to framer.wiki subdomains that reference cryptocurrency credentials. Continuous re‑scanning of the host is advised in case the site becomes active again, and security teams should correlate any alerts that reference the observed page title with this indicator to catch related campaigns.