sso-coinhold-portal[.]framer[.]ai

This domain, sso-coinhold-portal.framer.ai, poses a high risk and is specifically designed as a crypto drainer, targeting cryptocurrency wallet credentials under the guise of a legitimate portal. The domain has been taken offline, but it remains a critical threat due to its sophisticated impersonation of Coinhold, a known crypto platform. Security analysts have flagged it as an active phishing attempt aiming to drain digital assets from unsuspecting users.

Technical indicators paint a stark picture: VirusTotal reports that 15 out of 95 security vendors flag this domain as malicious, confirming its dangerous nature. It is hosted on IP address 52.223.52.2 and was registered through CSC Corporate Domains, Inc., with a creation date of January 6, 2018, which gives it an appearance of legitimacy. The domain currently resolves to a 'Site Not Found' page on Framer, but it previously held a Let's Encrypt SSL certificate (E8) that made it appear secure. Two security blocklists have already marked it, and Google Safe Browsing specifically flags it for phishing. These combined data points underscore the coordinated effort behind this credential theft campaign.

To protect against this specific threat, users should never enter any cryptocurrency wallet credentials or private keys on any website that appears suspicious, especially those mimicking official portals like Coinhold. Enable two-factor authentication on all crypto accounts and use a hardware wallet for large holdings. Regularly monitor your wallet for unauthorized transactions and report any suspicious activity to your platform's support team. If you have already entered information on this domain, immediately transfer funds to a new wallet and change all associated passwords.