web-coinbasehelp-com[.]framer[.]ai

On 25 July 2026 the domain web-coinbasehelp-com.framer.ai was observed hosting a Coinbase brand‑impersonation page titled “Sign In | Coinbase.com - Help”. The site resolved to the IPv4 address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, indicating the domain is served from Amazon Route 53 DNS. The hosting infrastructure delivered content over HTTPS using a Let’s Encrypt certificate (E8) and advertised HTTP/3, HSTS and React‑based Framer Sites technology. An HTTP request returned a 404 status, suggesting the malicious page may have been removed or redirected before analysis.

The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc. and has since been taken offline. It was listed on a single security blocklist and was blocked by the PhishDestroy service. VirusTotal scans reported detections by two of ninety‑five AV engines, providing independent confirmation of malicious intent. The page’s title explicitly references Coinbase, and the intelligence classifies the campaign as a crypto‑scam, aligning with the brand‑impersonation objective.

Evidence gaps remain: the exact content of the landing page was not captured, so the presence of credential‑capture forms or additional redirection behavior cannot be confirmed. Likewise, no public Safe Browsing or OTX identifiers were supplied. Defenders should continue to monitor the associated IP address and Amazon‑owned nameservers for any re‑use, enforce domain‑level blocking for the full sub‑domain, and update email and web filters with the observed indicators of compromise. Incident response teams should also consider the possibility of related infrastructure under the same registrar or DNS provider when investigating similar Coinbase‑targeted campaigns.