combase[.]framer[.]media

PhishDestroy has identified combase.framer.media as a brand impersonation phishing domain targeting Coinbase users. The site masquerades as a legitimate Coinbase Pro login page, attempting to harvest account credentials and potentially drain cryptocurrency wallets. No specific drainer kit has been confirmed, but the threat is consistent with credential theft and subsequent asset theft.

Technical analysis reveals that combase.framer.media has a VirusTotal detection rate of 4 out of 95 security vendors, indicating moderate but notable malicious recognition. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2. It uses a Let's Encrypt SSL certificate (E7) to appear legitimate. The site appears on at least three security blocklists, though it is not currently flagged by Google Safe Browsing.

As of the latest assessment, combase.framer.media is offline, suggesting it may have been taken down or is inactive. However, the domain remains registered and could be reactivated. Users who have interacted with this site should immediately change their Coinbase passwords and enable two-factor authentication. Always verify the authenticity of login pages by navigating directly to the official Coinbase website. For ongoing protection, check suspicious domains on PhishDestroy before entering any credentials.