coinbase-extn[.]framer[.]ai

The domain coinbase-extn.framer.ai was registered through CSC Corporate Domains, Inc. on 06 January 2018 and is hosted on Amazon Web Services infrastructure identified by ASN 16509 in the United States, resolving to IP 52.223.52.2. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and advertised the page title “Coinbase Extension: Your Guide,” which aligns with a declared crypto‑scam impersonating the Coinbase brand. Technical fingerprints show the use of Framer Sites, React, HSTS and HTTP/3, indicating a modern web stack typical for fraudulent copycat pages. VirusTotal recorded detections from 12 of 95 scanning engines, and Google Safe Browsing classified the domain as a social‑engineering threat.

The domain was listed on a single public blocklist and was previously blocked by the PhishDestroy service. Current HTTP response is 404 and the site is reported as offline, but the historical evidence confirms a deliberate attempt to lure cryptocurrency users by mimicking a Coinbase extension. Defenders should continue to enforce domain‑based blocking for coinbase-extn.framer.ai, monitor its IP address for any re‑activation, and include the associated TLS fingerprint in threat‑intel feeds.

Because the underlying AWS nameservers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns) are shared with many legitimate services, broader IP‑range or ASN‑based controls may be required to prevent future abuse. Security teams should also alert end‑users that any unsolicited request to install a “Coinbase Extension” originating from a framer.ai subdomain is untrusted, and encourage verification through official Coinbase channels. Ongoing vigilance is recommended, as the domain’s offline status does not guarantee that the threat actor will not redeploy the campaign under a new subdomain or similar naming pattern.