coin-extension[.]framer[.]ai

The site coin-extension.framer.ai posed as a cryptocurrency management guide under the impersonated brand Coinbase, titled "Coinbase Extension – Guide to Secure and Seamless Crypto Management." It constituted a cryptocurrency scam threat, likely aiming to deceive users into providing credentials or installing malicious software under the guise of a security guide.

Technical analysis revealed 8 out of 95 security vendors flagged the domain on VirusTotal. The domain was registered through CSC Corporate Domains, Inc., with a creation date of 2018-01-06. It resolved to IP 35.71.142.77 in the United States, hosted on AS16509 (Amazon.com, Inc.), and used an SSL certificate from Let's Encrypt. Nameservers were provided by Amazon Web Services (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). Google Safe Browsing flagged it for SOCIAL_ENGINEERING, and it appeared on one blocklist.

The site is currently offline/down. Given the impersonation of a legitimate brand, multiple security vendor detections, and active Google Safe Browsing flagging, the risk level is high for users who may have previously encountered the site. No further active threat is posed while offline.