coinbase-extension[.]framer[.]media

Analysis indicates that the domain coinbase-extension.framer.media was registered on November 19, 2021 through CSC Corporate Domains, Inc. The domain resolves to IP 35.71.142.77, an Amazon.com, Inc. host (AS16509) located in the United States. The presence of a Let's Encrypt certificate issued by the E7 authority, together with detected technologies such as Framer Sites, React, HSTS and HTTP/3, shows that the site was built with contemporary web frameworks. HTTP requests return a 404 status and the page title is “Site Not Found | Framer”, confirming that the content is no longer reachable and that the current status is offline. Despite the absence of a live payload, multiple external indicators flag the domain as malicious.

Google Safe Browsing classifies it as a social engineering threat, and VirusTotal reports that seven of ninety‑three security vendors have flagged the domain. It appears on the PhishDestroy blocklist, reinforcing the view that it was used for brand impersonation targeting Coinbase in a crypto‑scam context. The known scam type is listed as a crypto scam, and the brand target is explicitly Coinbase. Uncertainty remains regarding the exact phishing page layout, credential‑capture mechanisms, or any additional malicious payload because the site returns a 404 and no further content has been captured.

Defenders should proactively block the domain and its resolved IP address at network perimeters, update DNS filtering rules, and ensure endpoint protection signatures incorporate the seven vendor detections. User‑education programmes should emphasize caution when encountering unsolicited communications referencing Coinbase, especially URLs that contain “coinbase‑extension”. Continuous monitoring of the registrar CSC Corporate Domains, Inc. for similarly patterned domains is recommended to detect future iterations of this infrastructure.