SafeMode - Analysis: officials-coensmart.framer.media

Visual Capture

Screenshot of officials-coensmart.framer.media

Detection Info

https://officials-coensmart.framer.media/

Detected Brand

Coinbase

Country

International

Confidence

100%

HTTP Status

200

Report ID

a8c26280-f4a…

Analyzed

2026-01-26 22:58

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T114C16333D510E81A1FB6958CFAC0E19C9267D20BF63098C7B2C5615F6AC1EF598A137D
CONTENT ssdeep	96:uyC3aR1sYlYfMmORR1E8VConyro+ByOhl:umdCfMmUU8VCoUn

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	88dd227da8d5a2d5
VISUAL aHash	ff187e1818000041
VISUAL dHash	b271e8b2300e86c5
VISUAL wHash	ff007e18bcff4041
VISUAL colorHash	38006000080
VISUAL cropResistant	b271e8b2300e86c5

Code Analysis

Risk Score 76/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Cryptocurrency platform phishing
• Target: Coinbase users
• Method: Fake Coinbase Pro trading interface
• Exfil: Unknown, likely credential harvesting
• Indicators: Unofficial domain, framer.media hosting, obfuscated JavaScript
• Risk: HIGH - Potential for credential theft and account compromise

🔒 Obfuscation Detected

fromCharCode
base64_strings

🎯 Kit Endpoints

https://chalnikal3.wordpress.com/wp-content/uploads/2025/04/coinbase-pro-login.jpeg??

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, Banking, and Personal Info kit types, indicating a multi-purpose phishing framework.

Brand Impersonation

Impersonates Coinbase, a high-value cryptocurrency exchange target, increasing likelihood of victim engagement.

Obfuscation Techniques

10 obfuscation techniques detected, suggesting active evasion of detection and analysis.

Lack of Form Fields

Absence of visible form fields may indicate hidden or dynamically loaded credential harvesting mechanisms.

Minimal JavaScript Footprint

Small JavaScript size (0.03 MB) may indicate lightweight, focused malicious code designed for efficiency.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Coinbase users (International)

Attack Method

Brand impersonation + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, Banking, Personal Info
10 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Coinbase

Official Website

https://www.coinbase.com

Fake Service

Cryptocurrency wallet connection or account verification

⚔️ Attack Methodology

Primary Method: Wallet Connection Hijacking

Targets Coinbase users by mimicking the official wallet connection interface. The phishing page likely prompts victims to connect their cryptocurrency wallet (e.g., MetaMask, Coinbase Wallet) to a malicious smart contract, enabling unauthorized token approvals or direct asset theft.

Secondary Method: Credential Harvesting

Although no visible form fields are present, the Credential Harvester kit type suggests the page may dynamically capture login credentials (email, password, 2FA codes) via hidden or injected forms, transmitting them to an attacker-controlled server.

Target Blockchain

Ethereum

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain

officials-coensmart.framer.media

Registered

Unknown

Registrar

None

Status

Age unknown

🦠 Malicious Files

Main File

File Size

Small, obfuscated JavaScript file likely containing credential harvesting or wallet hijacking logic.

📊 Attack Flow Diagram

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Total Code Size

25.9 KB

🔗 API Endpoints Detected

Other

4

🔐 Obfuscation Detected

: Light
: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘