conebasee-wllt-ext[.]framer[.]ai

On 23 July 2026 a technical assessment was completed for the domain conebasee-wllt-ext.framer.ai. The site is currently offline, returning HTTP 404, and was flagged by PhishDestroy as a brand‑impersonation attempt targeting Coinbase. The page title registered in historic captures reads “Coinbase Wallet Extension – Manage Crypto Securely Online”, indicating a direct attempt to mimic the official Coinbase wallet extension. The domain was created on 6 January 2018 and is registered through CSC Corporate Domains, Inc. Its DNS is served by four AWS name servers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns).

Infrastructure analysis shows the domain resolves to IP 35.71.142.77, an Amazon Web Services address located in the United States and belonging to AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Let’s Encrypt (CN E8), and the site employed modern web stacks including Framer Sites, React, HSTS, and HTTP/3. Scamadviser assigns a trust score of 1 / 100, and the domain appears on a single security blocklist. VirusTotal reports that 15 of 95 scanning engines flagged the domain, reinforcing the malicious classification.

The primary malicious behavior is identified as a crypto‑scam that impersonates Coinbase, though the exact payload or credential‑harvesting mechanism cannot be confirmed because the site is no longer reachable. Defenders should continue to block the domain and its resolved IP at perimeter and DNS layers, add the associated AWS name servers to watchlists, and monitor for any reuse of the IP range in future campaigns. Ongoing intelligence gathering should focus on collecting any archived page content, phishing emails, or victim reports that reference the domain to enrich attribution and to detect possible re‑deployment under a different sub‑domain.