coinbase-web[.]framer[.]media

The domain coinbase-web.framer.media was observed hosting a page with the title "Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust," clearly indicating an attempt to impersonate the Coinbase brand. The site was flagged by Google Safe Browsing for social engineering, and 18 of 95 security vendors on VirusTotal marked it as malicious, confirming a consensus of threat detection. Technical analysis shows the domain resolves to the IP address 52.223.52.2, an Amazon Web Services host located in the United States and associated with ASN 16509 (Amazon.com, Inc.). The SSL certificate is issued by Let’s Encrypt (E7), a common free certificate authority, which does not provide any indication of legitimacy in this context.

DNS records list four AWS‑managed nameservers (ns-1267.awsdns-30.org, ns-535.awsdns-02.net, ns-1854.awsdns-39.co.uk, ns-97.awsdns-). The domain was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc., a registrar often used for disposable or short‑lived malicious sites. The web stack identified includes Framer Sites, React, HSTS, and HTTP/3, technologies that are frequently employed by phishing kits to quickly replicate legitimate interfaces. HTTP probing returned a 404 status, and the site has since been taken offline, but historical data indicates it was actively serving the fraudulent title.

Reputation services assign a trust score of 1 out of 100 on Scamadviser, and the domain appears on at least one security blocklist, with PhishDestroy confirming the block. While the site is no longer reachable, defenders should continue to monitor the associated IP range and AWS nameserver set for similar patterns, update URL filtering rules to include the exact domain, and consider broader blocks on any subdomains under framer.media that reference Coinbase‑related keywords.