portal-coin-bases[.]framer[.]media

The domain portal-coin-bases.framer.media is a phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a legitimate cryptocurrency platform to deceive victims into disclosing login credentials or sensitive information, classified as a cryptocurrency scam. As of the latest verification, portal-coin-bases.framer.media has been taken offline, though it previously posed an elevated risk of credential theft without evidence of a drainer kit.

Technical analysis reveals that portal-coin-bases.framer.media was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and alphaMountain.ai. The domain is registered through CSC Corporate Domains, Inc., with a creation date of February 21, 2026, and resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure in the US. It appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Let's Encrypt (E7). The observed page title was 'Site Not Found | Framer,' with an HTTP 404 status, and technologies detected include Framer Sites, React, HSTS, and HTTP/3. Google Safe Browsing did not flag the domain at the time of assessment.

Individuals who interacted with portal-coin-bases.framer.media should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraudulent activity to Coinbase support. Victims are advised to report the phishing domain to their local cybercrime unit, the FBI’s Internet Crime Complaint Center (IC3), or platforms like Google Safe Browsing and PhishTank to aid in takedown efforts.