SafeMode - Analysis: officials-coensmart.framer.media

Captura Visual

Screenshot of officials-coensmart.framer.media

Informações de Detecção

https://officials-coensmart.framer.media/

Detected Brand

Coinbase

Country

International

Confiança

100%

HTTP Status

200

Report ID

a8c26280-f4a…

Analyzed

2026-01-26 22:58

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T114C16333D510E81A1FB6958CFAC0E19C9267D20BF63098C7B2C5615F6AC1EF598A137D
CONTENT ssdeep	96:uyC3aR1sYlYfMmORR1E8VConyro+ByOhl:umdCfMmUU8VCoUn

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	88dd227da8d5a2d5
VISUAL aHash	ff187e1818000041
VISUAL dHash	b271e8b2300e86c5
VISUAL wHash	ff007e18bcff4041
VISUAL colorHash	38006000080
VISUAL cropResistant	b271e8b2300e86c5

Análise de Código

Risk Score 76/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing de plataforma de criptomoeda
• Alvo: Usuários do Coinbase
• Método: Interface falsa de negociação do Coinbase Pro
• Exfil: Desconhecido, provavelmente coleta de credenciais
• Indicadores: Domínio não oficial, hospedagem framer.media, JavaScript ofuscado
• Risco: ALTO - Potencial para roubo de credenciais e comprometimento da conta

🔒 Obfuscation Detected

fromCharCode
base64_strings

🎯 Kit Endpoints

https://chalnikal3.wordpress.com/wp-content/uploads/2025/04/coinbase-pro-login.jpeg??

📊 Detalhamento da Pontuação de Risco

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, Banking, and Personal Info kit types, indicating a multi-purpose phishing framework.

Brand Impersonation

Impersonates Coinbase, a high-value cryptocurrency exchange target, increasing likelihood of victim engagement.

Obfuscation Techniques

10 obfuscation techniques detected, suggesting active evasion of detection and analysis.

Lack of Form Fields

Absence of visible form fields may indicate hidden or dynamically loaded credential harvesting mechanisms.

Minimal JavaScript Footprint

Small JavaScript size (0.03 MB) may indicate lightweight, focused malicious code designed for efficiency.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

Coinbase users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, Banking, Personal Info
10 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Coinbase

Official Website

https://www.coinbase.com

Fake Service

Cryptocurrency wallet connection or account verification

⚔️ Metodologia de Ataque

Primary Method: Wallet Connection Hijacking

Targets Coinbase users by mimicking the official wallet connection interface. The phishing page likely prompts victims to connect their cryptocurrency wallet (e.g., MetaMask, Coinbase Wallet) to a malicious smart contract, enabling unauthorized token approvals or direct asset theft.

Secondary Method: Credential Harvesting

Although no visible form fields are present, the Credential Harvester kit type suggests the page may dynamically capture login credentials (email, password, 2FA codes) via hidden or injected forms, transmitting them to an attacker-controlled server.

Target Blockchain

Ethereum

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio

officials-coensmart.framer.media

Registered

Unknown

Registrar

None

Estado

Age unknown

🦠 Malicious Files

Main File

File Size

Small, obfuscated JavaScript file likely containing credential harvesting or wallet hijacking logic.

📊 Diagrama de Fluxo de Ataque

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Total Code Size

25,9 KB

🔗 API Endpoints Detected

Other

4

🔐 Obfuscation Detected

: Light
: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED WITH PHISHING LINK                    │
│    - Fake Coinbase page delivered via email/message      │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM CONNECTS WALLET TO FAKE SITE                   │
│    - Fake "Connect Wallet" prompt displayed              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. WALLET CONNECTION HIJACKED                            │
│    - Attacker intercepts connection request             │
│    - Gains access to wallet session                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. TRANSACTION REQUEST SENT                              │
│    - Fake transaction prompt appears                    │
│    - Victim unknowingly approves malicious transfer     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION                                     │
│    - Stolen credentials/wallet data sent via HTTP POST  │
└──────────────────────────────────────────────────────────┘