coinbase-extensoin[.]framer[.]media

The domain coinbase-extensoin.framer.media was registered on 19 November 2021 through CSC Corporate Domains, Inc. and resolves to the Amazon-owned address 52.223.52.2, which is advertised as part of ASN 16509 (Amazon.com, Inc.) and located in the United States. An SSL certificate issued by Let’s Encrypt (E7) is present, and the site delivers content over HTTP/3 with HSTS enabled, indicating modern web stack usage. Automated analysis identified the underlying platform as Framer Sites running React, a common choice for quickly deployed clone sites. The HTTP response is a 404 with the page title "Site Not Found | Framer," suggesting the content has been taken down; the current status is marked offline and the domain is listed on at least one security blocklist.

VirusTotal scans returned six positive detections out of ninety‑five AV engines, and the domain is actively blocked by the PhishDestroy feed. The site is classified as a crypto‑related scam that impersonates Coinbase, aligning with the recorded brand target. Nameserver configuration includes ns-535.awsdns-02.net, ns-1854.awsdns-39.co.uk, ns-1267.awsdns-30.org, and ns-97.awsdns-?.

The available evidence confirms the domain was used for brand impersonation, but the exact payload or credential‑harvesting mechanisms have not been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation or related subdomains hosted on the same IP range, and update threat‑intel feeds with the observed indicators, including the resolver IP, SSL fingerprint, and the six VirusTotal detections. Ongoing observation is recommended to detect potential re‑use of the infrastructure for future campaigns.