ext-conbasee[.]framer[.]ai

PhishDestroy identifies ext-conbasee.framer.ai as an active Coinbase-brand impersonation phishing campaign under investigation, posing as a fraudulent 'Coinbase Extension – Secure Web3 Wallet' web page. The domain’s low detection rate and deliberate mimicry of a major cryptocurrency brand indicate a high-risk attempt to harvest user credentials and Web3 wallet access. This threat is not merely generic phishing—it is a targeted brand impersonation attack designed to exploit trust in Coinbase’s name and deceive users into installing malicious browser extensions or surrendering sensitive wallet recovery phrases. The risk level remains under investigation due to evolving infrastructure, but current indicators strongly suggest malicious intent and potential for widespread compromise.

This domain was flagged by PhishDestroy’s seed c6bdef with the following technical indicators: it resolves to IP address 31.43.161.6, hosts a Let’s Encrypt SSL certificate, and presents a page titled 'Coinbase Extension – Secure Web3 Wallet' on framer.ai’s subdomain platform. The domain currently shows 16/95 detections on VirusTotal, indicating no AV or security vendor flagging as of the latest scan. While registrar and creation date are not provided in open sources, the use of framer.ai’s platform and the immediate availability of the malicious page suggest rapid deployment for phishing purposes. It is not currently listed on major blocklists such as PhishTank, OpenPhish, or Google Safe Browsing, and WHOIS trust scores remain neutral due to the domain’s recent appearance.

To mitigate exposure to this specific threat, users must avoid accessing ext-conbasee.framer.ai or any framer.ai subdomain claiming to offer 'Coinbase Extensions' or 'Web3 Wallets.' Only download cryptocurrency-related software and browser extensions directly from the official Coinbase website (coinbase.com) or verified distribution points such as official app stores or GitHub under Coinbase’s verified account. Enable multi-factor authentication (MFA) on all crypto accounts and use hardware wallets for high-value assets. Security teams should block the IP 31.43.161.6 and monitor DNS for similar Coinbase-branded impersonations. Report any interactions with this domain to Coinbase’s abuse team and your internal security operations center. Always verify URLs via official sources before entering credentials or downloading software.