Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://officials-coensmart.framer.media/
Detected Brand
Coinbase
Country
International
Confidence
100%
HTTP Status
200
Report ID
f8849e5c-d81…
Analyzed
2026-01-27 12:45
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T114C16333D510E81A1FB6958CFAC0E19C9267D20BF63098C7B2C5615F6AC1EF598A137D |
|
CONTENT
ssdeep
|
96:uyC3aR1sYlYfMmORR1E8VConyro+ByOhl:umdCfMmUU8VCoUn |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
88dd227da8d5a2d5 |
|
VISUAL
aHash
|
ff187e1818000041 |
|
VISUAL
dHash
|
b271e8b2300e86c5 |
|
VISUAL
wHash
|
ff007e18bcff4041 |
|
VISUAL
colorHash
|
38006000080 |
|
VISUAL
cropResistant
|
b271e8b2300e86c5 |
Code Analysis
Risk Score
76/100
Threat Level
ALTO
🎣 Credential Harvester
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Cryptocurrency exchange phishing
• Target: Coinbase Pro users
• Method: Imitates the Coinbase Pro trading platform
• Exfil: Unknown, likely credential and API key harvesting
• Indicators: Unofficial framer.media domain, "Made in Framer" watermark
• Risk: HIGH - Potential for account takeover and fund theft
🔒 Obfuscation Detected
- fromCharCode
- base64_strings
🎯 Kit Endpoints
- https://chalnikal3.wordpress.com/wp-content/uploads/2025/04/coinbase-pro-login.jpeg??
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester, Banking, and Personal Info kit types with high obfuscation (10 techniques).
Brand Impersonation
Impersonates Coinbase, a high-value cryptocurrency exchange target.
Obfuscation
10 obfuscation techniques detected, indicating evasion of detection.
Malicious UI Elements
Contains 'Deposit' and 'Withdraw' buttons, typical of crypto wallet phishing.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Coinbase users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Unknown
Risk Assessment
HIGH - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking, Personal Info
- 10 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Coinbase
Official Website
https://www.coinbase.com
Fake Service
Cryptocurrency exchange and wallet services
⚔️ Attack Methodology
Primary Method: Crypto Wallet Credential Harvesting
The phishing page mimics Coinbase's login interface to trick users into entering their wallet credentials. The harvested credentials are likely exfiltrated in real-time to an attacker-controlled server for immediate exploitation.
Secondary Method: Fake Transaction Simulation
The presence of 'Deposit' and 'Withdraw' buttons suggests the page may simulate transactions to deceive users into believing they are interacting with a legitimate platform, potentially leading to further credential or seed phrase exposure.
Target Blockchain
Ethereum
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
officials-coensmart.framer.media
Registered
Unknown
Registrar
None
Status
Age unknown
🦠 Malicious Files
Main File
File Size
Small JavaScript file with high obfuscation, likely used for credential harvesting.
📊 Attack Flow Diagram
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE │
│ - Email/SMS with fake Coinbase link │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE COINBASE SITE │
│ - Cloned Coinbase login page displayed │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL INPUT │
│ - Victim enters wallet credentials │
│ - Form appears identical to legitimate Coinbase │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. CREDENTIAL EXFILTRATION │
│ - Data sent via HTTP POST to attacker-controlled │
│ server (standard form submission) │
└──────────────────────────────────────────────────────────┘
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE │
│ - Email/SMS with fake Coinbase link │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE COINBASE SITE │
│ - Cloned Coinbase login page displayed │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL INPUT │
│ - Victim enters wallet credentials │
│ - Form appears identical to legitimate Coinbase │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. CREDENTIAL EXFILTRATION │
│ - Data sent via HTTP POST to attacker-controlled │
│ server (standard form submission) │
└──────────────────────────────────────────────────────────┘
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for officials-coensmart.framer.media
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.