signiin-coieenbase-pro[.]framer[.]media

The domain signiin-coieenbase-pro.framer.media is identified as a brand impersonation threat specifically targeting Base, a cryptocurrency platform. Currently, this domain is offline, but prior analysis confirms its malicious intent as a phishing infrastructure component. The domain was designed to deceive users by mimicking legitimate Base authentication portals, likely to harvest credentials or distribute malicious payloads. Analysis of technical indicators reveals significant red flags. The domain was flagged by 20 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It was registered through CSC Corporate Domains, Inc., a registrar frequently associated with high-risk domains. Infrastructure analysis shows the domain resolved to IP address 52.223.52.2 and was created on February 21, 2026, an anomalous future date suggesting potential data manipulation or misreporting. The domain appears on two security blocklists, and Google Safe Browsing explicitly flags it as phishing. The SSL certificate was issued by Let's Encrypt (serial number E7), a common certificate authority exploited by threat actors due to its free and automated issuance process. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the underlying infrastructure may remain active or be repurposed. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Security teams should monitor for similar impersonation patterns, particularly domains combining "signin" or "login" with cryptocurrency brand names. Users who may have interacted with this domain should reset credentials for any associated accounts and enable multi-factor authentication. Proactive hunting for related domains registered through the same registrar or resolving to the same IP range is recommended to identify potential secondary threats.