SafeMode - Analysis: officials-coensmart.framer.media

Captura Visual

Screenshot of officials-coensmart.framer.media

Información de Detección

https://officials-coensmart.framer.media/

Detected Brand

Coinbase

Country

International

Confianza

100%

HTTP Status

200

Report ID

a8c26280-f4a…

Analyzed

2026-01-26 22:58

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T114C16333D510E81A1FB6958CFAC0E19C9267D20BF63098C7B2C5615F6AC1EF598A137D
CONTENT ssdeep	96:uyC3aR1sYlYfMmORR1E8VConyro+ByOhl:umdCfMmUU8VCoUn

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	88dd227da8d5a2d5
VISUAL aHash	ff187e1818000041
VISUAL dHash	b271e8b2300e86c5
VISUAL wHash	ff007e18bcff4041
VISUAL colorHash	38006000080
VISUAL cropResistant	b271e8b2300e86c5

Análisis de Código

Risk Score 76/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Suplantación de identidad de plataforma de criptomonedas
• Objetivo: Usuarios de Coinbase
• Método: Interfaz falsa de comercio de Coinbase Pro
• Exfil: Desconocido, probablemente recolección de credenciales
• Indicadores: Dominio no oficial, alojamiento en framer.media, JavaScript ofuscado
• Riesgo: ALTO - Potencial de robo de credenciales y compromiso de cuenta

🔒 Obfuscation Detected

fromCharCode
base64_strings

🎯 Kit Endpoints

https://chalnikal3.wordpress.com/wp-content/uploads/2025/04/coinbase-pro-login.jpeg??

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, Banking, and Personal Info kit types, indicating a multi-purpose phishing framework.

Brand Impersonation

Impersonates Coinbase, a high-value cryptocurrency exchange target, increasing likelihood of victim engagement.

Obfuscation Techniques

10 obfuscation techniques detected, suggesting active evasion of detection and analysis.

Lack of Form Fields

Absence of visible form fields may indicate hidden or dynamically loaded credential harvesting mechanisms.

Minimal JavaScript Footprint

Small JavaScript size (0.03 MB) may indicate lightweight, focused malicious code designed for efficiency.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

Coinbase users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, Banking, Personal Info
10 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Coinbase

Official Website

https://www.coinbase.com

Fake Service

Cryptocurrency wallet connection or account verification

⚔️ Metodología de Ataque

Primary Method: Wallet Connection Hijacking

Targets Coinbase users by mimicking the official wallet connection interface. The phishing page likely prompts victims to connect their cryptocurrency wallet (e.g., MetaMask, Coinbase Wallet) to a malicious smart contract, enabling unauthorized token approvals or direct asset theft.

Secondary Method: Credential Harvesting

Although no visible form fields are present, the Credential Harvester kit type suggests the page may dynamically capture login credentials (email, password, 2FA codes) via hidden or injected forms, transmitting them to an attacker-controlled server.

Target Blockchain

Ethereum

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio

officials-coensmart.framer.media

Registered

Unknown

Registrar

None

Estado

Age unknown

🦠 Malicious Files

Main File

File Size

Small, obfuscated JavaScript file likely containing credential harvesting or wallet hijacking logic.

📊 Diagrama de Flujo de Ataque

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Total Code Size

25,9 KB

🔗 API Endpoints Detected

Other

4

🔐 Obfuscation Detected

: Light
: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘