extension-coin[.]framer[.]media

The domain extension-coin.framer.media was observed on July 22, 2026 hosting a page titled "Coinbase Extension: Your Gateway to a Seamless Crypto Experience," indicating a direct attempt to impersonate Coinbase. The site was secured with a Let’s Encrypt certificate (E7) and responded with HTTP 404, suggesting the malicious content had been removed or the host was configured to hide the page after detection. Infrastructure analysis shows the domain resolves to IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration records list CSC Corporate Domains, Inc. as the registrar, and the authoritative nameservers are ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1 (truncated).

Technical fingerprints reveal the use of Framer Sites, React, HSTS, and HTTP/3, indicating a modern web stack often leveraged for phishing fronts. The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, providing limited but corroborating threat intelligence. The campaign is classified as an investment scam, targeting users seeking cryptocurrency services through a fabricated Coinbase extension.

While the exact page content beyond the title has not been captured, the combination of brand‑specific language, registrar and hosting details, and detection by multiple security sources confirms a credible impersonation attempt. Defenders should add the domain and its resolving IP to blocklists, monitor for similar sub‑domains or infrastructure reuse, and consider updating URL filtering rules to capture variants referencing "Coinbase Extension". Continuous observation of the registrar’s activity and the AWS nameserver set is recommended to detect future re‑hosting of related payloads.