sso-base-wallts[.]framer[.]media

The domain sso-base-wallts.framer.media was identified as a brand‑impersonation site targeting Coinbase users, specifically masquerading as a Coinbase Wallet extension. Infrastructure analysis shows the domain resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate is issued by Let’s Encrypt under the E7 identifier, and the site enforces HSTS while supporting HTTP/3, indicating a modern web stack. Front‑end technologies detected include Framer Sites and React, consistent with the use of a templated site builder.

The HTTP response returned a 404 status code at the time of scanning, and the page title presented to crawlers reads "Coinbase Wallet Extension – Securely Access Web3 & Manage," directly referencing the targeted brand. Registration data lists CSC Corporate Domains, Inc. as the registrar, and the domain is serviced by four Amazon Route 53 nameservers (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and a partially captured ns-1 entry). Threat intelligence indicates the site was flagged by PhishDestroy and appears on at least one external security blocklist. VirusTotal analysis recorded three detections out of ninety‑three scanning engines, reinforcing the malicious classification despite the relatively low detection count.

The site is currently marked as offline, suggesting the operators may be testing or have withdrawn the payload temporarily. Defenders should update URL filtering rules to block the full domain and any sub‑domains, monitor DNS queries for the associated AWS nameservers, and add the IP address 52.223.52.2 to network‑level blocklists. Email security gateways should be tuned to flag messages referencing the exact page title or the phrase "Coinbase Wallet Extension" to catch any residual phishing attempts.