coinbse-login[.]framer[.]media

The domain coinbse-login.framer.media is a high-risk phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a legitimate Coinbase login portal to deceive victims into entering credentials, constituting a fake exchange scam. No crypto drainer kit was identified. The site is currently taken offline, but prior activity posed a significant threat of credential theft and financial fraud.

Technical indicators confirm the malicious nature of coinbse-login.framer.media. The domain is flagged by 12 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and BitDefender. Google Safe Browsing explicitly flags it for 'SOCIAL_ENGINEERING' under phishing classifications. It appears on one security blocklist, PhishDestroy, and is registered through CSC Corporate Domains, Inc., with a creation date of November 19, 2021. The domain resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US, and uses an SSL certificate issued by Let's Encrypt (E7). The observed page title is 'Site Not Found | Framer', and the HTTP status returns a 404 error. Technologies detected include Framer Sites, React, HSTS, and HTTP/3.

Victims who interacted with coinbse-login.framer.media should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized transactions or suspicious activity. Report the phishing domain to Coinbase’s security team via their official abuse reporting channels. Additionally, submit the domain to Google Safe Browsing, PhishTank, and other threat-sharing platforms to aid in broader mitigation efforts.