coinbas-echrome-extension[.]framer[.]media

This domain, coinbas-echrome-extension.framer.media, was registered on 2026-02-21 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77 (AS16509, United States). The site presented a TLS certificate issued by Let’s Encrypt (E7) and employed HSTS and HTTP/3, indicating a modern web stack. Automated scans identified Framer Sites and React as the underlying technologies. The HTTP response returned a 404 status, and the page title observed in the crawl was “Coinbase Chrome Extension – Secure Wallet Access in Your Browser,” explicitly referencing the Coinbase brand.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal recorded 11 detections out of 93 scanned security vendors. The domain is listed on a single external blocklist and has been taken down by PhishDestroy. Nameservers are ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1 (truncated). The combination of brand‑specific page title, Safe Browsing flag, and multiple vendor detections supports a classification of brand impersonation targeting Coinbase users.

Current evidence does not reveal the content of the page beyond the title, nor any credential‑harvesting forms, leaving the exact attack vector uncertain. Defenders should block the domain at DNS and proxy layers, monitor for traffic to the associated IP address, and incorporate the domain into threat‑intel feeds. Continued observation of the registrar and AWS hosting patterns is advised, as the infrastructure may be reused for future impersonation campaigns.