coinbase-ecten[.]framer[.]ai

Analysis indicates that the domain coinbase-ecten.framer.ai is a confirmed phishing site targeting Coinbase users, currently offline as of July 22, 2026. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, and resolves to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509, United States). Nameservers include ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, further confirming AWS infrastructure. The SSL certificate is issued by Let's Encrypt (E8), a common choice for both legitimate and malicious sites.

The page title, 'Download Coinbase Extension | Secure Browser-Based Crypto Wallet®™,' explicitly impersonates Coinbase, a cryptocurrency exchange platform, aligning with the scam type classified as a 'Crypto Scam.' Detection data reveals that the domain appears on one security blocklist (PhishDestroy), and five of 95 security vendors on VirusTotal flagged it as malicious. The HTTP status is currently 404, suggesting the site has been taken down or is no longer accessible. Technologies detected on the domain include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not inherently indicate malicious intent. The domain's creation date predates the phishing activity, which is not uncommon for compromised or repurposed domains.

While the exact content of the phishing page is not analyzed, the combination of the page title, scam classification, and detection by security vendors strongly supports the conclusion that this was a crypto wallet phishing operation. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Organizations using Coinbase or similar platforms should monitor for user reports of exposure to this domain and conduct internal investigations if any interactions are detected.