chrome-extn[.]framer[.]ai

The domain chrome-extn.framer.ai was observed hosting a fraudulent page that mimics a Coinbase Chrome extension, as indicated by the page title "Coinbase Chrome Extension - Chrome Web Store." The site operated from a single IPv4 address (52.223.52.2) owned by Amazon.com, Inc. (AS16509) and located in the United States. Registration records show the domain was created on 2018-01-06 and is registered through CSC Corporate Domains, Inc., with four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The TLS certificate presented is issued by Let’s Encrypt (E8) and the server enforces HSTS while supporting HTTP/3, consistent with modern web stacks; technology fingerprints include Framer Sites and React.

HTTP probing returned a 404 status code, suggesting the malicious content may have been removed or hidden. The domain has been flagged by multiple security services: Google Safe Browsing classifies it as a social engineering threat, PhishDestroy has blocked it, and it appears on one external blocklist. VirusTotal scans reported 11 of 95 security vendors marking the domain as malicious, reinforcing the suspicion of a crypto‑related scam.

Classification aligns with a "Crypto Scam" label and explicit impersonation of Coinbase. As of the report date (2026-07-24) the site is offline, but defenders should continue to block the associated IP address, monitor the registrar for any re‑registration attempts, and ensure that internal security policies deny traffic to the listed name servers. Continuous observation of threat intel feeds for renewed activity is advised.