pro-login-coinbase[.]framer[.]media

The domain pro-login-coinbase.framer.media posed a significant threat as a brand impersonation phishing site targeting Coinbase users. The page was designed to mimic the legitimate Coinbase login interface, with a title reading "Log-In Coinbase - Buy and Sell Bitcoin, Ethereum," and likely attempted to harvest credentials or deploy a crypto drainer. This type of attack is especially dangerous for cryptocurrency holders, as stolen login details can lead to immediate financial loss. The domain was registered through CSC Corporate Domains, Inc. on November 19, 2021, and resolved to IP address 35.71.142.77. VirusTotal analysis showed that 8 out of 95 security vendors flagged this domain as malicious, and it appeared on one security blocklist. The SSL certificate was issued by Let's Encrypt (E7), which is commonly abused by phishing sites due to its free and automated nature. As of the latest check, the domain has been taken offline, but similar threats may reappear. If any user visited this domain or entered credentials, they should immediately change their Coinbase password, enable two-factor authentication, and monitor their account for unauthorized transactions. It is also advisable to run a full antivirus scan and consider using a password manager to avoid reusing credentials. For ongoing protection, PhishDestroy provides real-time verification of suspicious domains and alerts users to emerging phishing campaigns.