connect-wallets-estion[.]framer[.]ai

PhishDestroy has analyzed the domain connect-wallets-estion.framer.ai, which was identified as a brand impersonation phishing attack targeting Coinbase users. This domain is now offline, but during its active period it posed a significant threat to cryptocurrency holders by mimicking the legitimate Coinbase wallet extension setup page. The page title was "Getting Started: Wallet Extension - Coinbase," designed to deceive visitors into entering sensitive credentials or installing malicious software.

Technical analysis reveals multiple red flags. The domain was created on April 4, 2023, and resolved to IP address 52.223.52.2. It was registered through CSC Corporate Domains, Inc. and secured with a Let's Encrypt SSL certificate (E8), which is commonly abused by phishers. VirusTotal flagged the domain as malicious by 8 out of 95 security vendors, and it appeared on three security blocklists. Google Safe Browsing also flagged it for phishing. These indicators collectively confirm the domain's malicious intent.

As the domain is now offline, the immediate threat has been neutralized. However, users should remain vigilant against similar phishing attempts. PhishDestroy recommends that Coinbase users always verify URLs before entering credentials, enable two-factor authentication, and report suspicious domains to security teams. Avoid clicking on unsolicited links claiming to be from cryptocurrency platforms, and always navigate directly to official websites.