log-coinbase-in[.]framer[.]ai

This domain, log-coinbase-in.framer.ai, presents a high risk to cryptocurrency users as a brand impersonation site specifically designed to drain digital assets. The threat type is a crypto drainer, where victims are tricked into connecting their wallets or entering private keys under the guise of a legitimate Coinbase login page. PhishDestroy has confirmed the domain is now offline, but similar domains may still be active.

Technical indicators paint a clear picture of malicious intent. The domain was created on May 13, 2026, and registered through CSC Corporate Domains, Inc. It resolves to IP address 31.43.160.6. VirusTotal analysis shows 12 out of 95 security vendors flagging this domain as malicious. It appears on 3 security blocklists and uses an SSL certificate from Let's Encrypt (E8) to appear legitimate. The page title was "Coinbase.com Login || Coinbase Help," directly impersonating the Coinbase brand to deceive users.

To protect against this specific threat, users should never connect their cryptocurrency wallets or enter sensitive information on sites that are not the official Coinbase domain (coinbase.com). Always verify URLs carefully, enable two-factor authentication, and use hardware wallets for added security. If you have already interacted with this domain, immediately revoke any wallet permissions and transfer funds to a new wallet. PhishDestroy recommends bookmarking official exchange URLs and using browser extensions that block known phishing domains. Stay vigilant—crypto drainers are constantly evolving to bypass detection.