xtension-coin-base[.]framer[.]ai

Analysis of xtension-coin-base.framer.ai shows a confirmed brand‑impersonation campaign targeting Coinbase users. The domain, registered on January 6, 2018 through CSC Corporate Domains, Inc., resolves to the Amazon Web Services address 35.71.142.77, which is announced by ASN 16509 (Amazon.com, Inc.) and geolocated to the United States. The site employed Framer Sites and React, advertised HSTS and HTTP/3, and presented a page title of "Coinbase Pro Extension – Trade Crypto Securely on Browser," directly referencing Coinbase’s professional trading offering. A Let’s Encrypt certificate (issuer E8) was active at the time of capture, and the HTTP response returned a 404 status, indicating that the malicious landing page is no longer reachable.

VirusTotal scans recorded 15 detections out of 95 security vendors, and the domain appears on a single external blocklist, with PhishDestroy confirming it as blocked. Nameserver configuration includes ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, consistent with AWS DNS hosting. The threat is classified as a crypto scam, leveraging the Coinbase brand to lure victims into installing a fraudulent browser extension or providing credentials.

Defenders should immediately add xtension-coin-base.framer.ai to DNS and web proxy blocklists, monitor the associated AWS IP range for similar activity, and enforce strict extension installation policies on corporate browsers. Continuous observation of Let’s Encrypt certificate renewals for this domain is advisable, as renewal could signal re‑activation. Given the domain’s offline status, threat actors may attempt to resurrect the site under a new subdomain; therefore, security teams should also watch for variations that incorporate "coin" or "extension" within the framer.ai namespace.