webcoimbase[.]framer[.]media

This domain, webcoimbase.framer.media, presents an elevated risk due to its clear attempt to impersonate the Base brand through a fabricated login interface. The specific threat is a crypto drainer, designed to trick users into connecting their wallets and surrendering assets. Although currently offline, the domain was active long enough to potentially compromise unsuspecting visitors.

Technical indicators paint a concerning picture. VirusTotal analysis shows 8 out of 95 security vendors flagging this domain as malicious, a significant detection rate. The domain was registered through CSC Corporate Domains, Inc. on February 21, 2026, and resolves to IP 35.71.142.77. Its SSL certificate was issued by Let's Encrypt (E7), lending a false sense of legitimacy. The page title, "My Framer Site," is generic and matches the subdomain structure of framer.media, a legitimate web hosting platform, which may have been abused for this campaign. The domain appears on 3 security blocklists and has been taken offline, but its short lifespan does not diminish the risk for those who encountered it.

Users should never interact with this domain. For anyone who may have connected a wallet or entered credentials, immediate action is required: revoke any token approvals, transfer assets to a new wallet, and enable two-factor authentication. To verify the safety of any Base-related site, always consult PhishDestroy's verification tool. Avoid clicking links from unsolicited messages, and bookmark official URLs directly. Staying vigilant against brand impersonation remains critical in the crypto space.