guide-coinbase[.]framer[.]media

The domain guide-coinbase.framer.media is flagged for brand impersonation targeting Coinbase users. Registration data shows the domain was created on November 19, 2021 through CSC Corporate Domains, Inc., and it resolves to the Amazon Web Services IP address 52.223.52.2, which is announced by AS16509 (Amazon.com, Inc.) and geolocated to the United States. The site presents a TLS certificate issued by Let’s Encrypt (E7) and enforces HSTS, while the underlying stack includes Framer Sites, React, and HTTP/3 support. The observed page title, "Coinbase Extension – Manage Your Crypto Securely in Your Browser," directly references Coinbase and suggests a crypto‑related extension, aligning with the classified scam type of a crypto scam.

HTTP probing returned a 404 status, indicating the page is not currently serving content, and the domain has been taken offline at the time of analysis. Threat intelligence shows the domain appears on a single security blocklist and is listed by PhishDestroy as a malicious resource. VirusTotal scans recorded six detections out of ninety‑three scanning vendors, providing additional confirmation of malicious intent. The authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-.

Although the site is presently offline, defenders should continue to block any traffic to this domain, monitor DNS queries for the listed name servers, and update web filtering rules to include the domain and its associated IP range. Incident responders should also advise users to disregard any unsolicited Coinbase‑related browser extension prompts and to verify official extensions through Coinbase’s verified channels. Ongoing surveillance of the hosting provider and related subdomains is recommended to detect potential re‑use of the same infrastructure for future impersonation campaigns.