coinbsase-extension[.]framer[.]ai

coinbsase-extension.framer.ai was observed hosting a page titled “Coinbase Extension | Secure Browser Wallet for Crypto & Web3”, a clear indication of brand impersonation targeting Coinbase users. The domain is registered through CSC Corporate Domains, Inc. and was created on 06 January 2018. DNS resolution points to the Amazon‑owned address 52.223.52.2, hosted in the United States under ASN 16509 (Amazon.com, Inc.). The site employed a Let’s Encrypt certificate (issuer “E8”) and presented HSTS and HTTP/3 support, alongside Framer Sites and React frameworks, yet returned an HTTP 404 status at the time of analysis.

Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal recorded six positive detections out of ninety‑five scanners. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Nameserver delegation includes ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, and ns‑635.awsdns.

Current monitoring indicates the site has been taken offline. Analysts should continue to block the resolved IP address and the fully qualified domain, incorporate the domain into threat‑intel feeds, and watch for future sub‑domains that reuse the same registrar or hosting infrastructure. Given the confirmed brand impersonation and multi‑vendor detections, defensive teams are advised to treat any traffic to this domain as malicious and to educate users about unsolicited wallet extensions that claim to be associated with Coinbase.