access-coin-base-pro[.]framer[.]media

The domain access-coin-base-pro.framer.media was observed hosting a page titled "Coinbase Pro Login | Secure Crypto Trading Platform," directly referencing Coinbase and indicating a crypto‑related impersonation campaign. DNS resolution points to the Amazon Web Services address 52.223.52.2, which belongs to AS16509 Amazon.com, Inc. in the United States. The domain was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc., a registrar known to host a variety of legitimate and malicious sites. Its authoritative nameservers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns‑, confirming that the domain is served from AWS infrastructure. An SSL certificate issued by Let’s Encrypt (type E7) was active, and the site advertised modern security features including HSTS and HTTP/3, while the front‑end stack was identified as Framer Sites running React.

Security scanning on VirusTotal recorded 14 positive detections out of 93 vendors, and the domain appears on a single external blocklist. PhishDestroy has taken the domain offline, and the current HTTP response is a 404 status code. The risk rating is elevated, and the incident is classified as a crypto scam that leverages brand impersonation of Coinbase.

Evidence confirms the domain’s intent to mislead users seeking Coinbase Pro services, but the exact content served at the time of detection cannot be verified because the site is now offline. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any new sub‑domains that resolve to the same AWS IP range. Analysts should also watch for similar Framer‑based credential‑harvesting sites targeting financial brands, and consider notifying the affected brand’s abuse team to aid in takedown coordination.