xplore-coinbase-exten[.]framer[.]media

This domain, xplore-coinbase-exten.framer.media, hosted a fraudulent cryptocurrency site impersonating the Coinbase brand. The page title displayed "Site Not Found | Framer," indicating the site is hosted on the Framer platform. The primary threat is social engineering, specifically a cryptocurrency scam designed to trick users into believing they are interacting with a legitimate Coinbase service.

Technical evidence confirms this threat. VirusTotal flagged the domain with 14 detections out of 95 scanners, and Google Safe Browsing flagged it for "SOCIAL_ENGINEERING." The domain is registered with CSC Corporate Domains, Inc., and was created on February 21, 2026. It resolves to IP address 35.71.142.77, hosted on AS16509 (Amazon.com, Inc.) in the United States. The site uses a Let's Encrypt SSL certificate (E7). It is listed on three blocklists and flagged by ChainPatrol, alphaMountain.ai, BitDefender, CRDF, and CyRadar.

The domain is currently DOWN/OFFLINE, but its DOM risk score is 83, indicating a high threat level. The combination of brand impersonation, confirmed social engineering flag, and multiple security vendor detections makes this a significant risk for cryptocurrency users.