get-coinebsed[.]framer[.]media

This domain, get-coinebsed.framer.media, poses a high-risk brand impersonation threat targeting users of a major cryptocurrency exchange platform. Analysis indicates the site mimics the legitimate Coinbase browser extension interface, presenting itself as 'Coinbase Extension | Secure Wallet Access in Your Browser.' The objective appears to be credential theft, specifically harvesting wallet login details or recovery phrases under false pretenses of secure access. Such tactics are commonly employed to facilitate unauthorized transactions or full account takeovers in cryptocurrency environments. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and currently resolves to the IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendor detection is substantial, with 20 out of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, and is explicitly classified as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encrypted connections but does not validate legitimacy, as phishing sites frequently exploit free certificate authorities to appear trustworthy. Users who visited get-coinebsed.framer.media should take immediate remediation steps to mitigate potential compromise. Any credentials, recovery phrases, or private keys entered on the site must be considered exposed and should be revoked or changed through official channels. Affected accounts should be reviewed for unauthorized transactions, and multi-factor authentication should be enabled if not already active. System scans using updated security tools are recommended to detect potential secondary payloads or malware. Users are advised to verify domain authenticity by cross-referencing official communications and avoiding links from untrusted sources, particularly those mimicking cryptocurrency services.