appcoinbaseio[.]framer[.]ai

Analysis of appcoinbaseio.framer.ai indicates a high‑risk brand‑impersonation operation targeting Coinbase users. The domain, created on January 06, 2018 and registered through CSC Corporate Domains, Inc., resolves to the IP address 52.223.52.2, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The site serves a page titled "Log In | Coinbase pro login®: | Sign In to Your Account - Log In@" and is classified as a crypto‑related scam. TLS is provided by a Let’s Encrypt certificate (issuer E8), and the server advertises HSTS and HTTP/3 support, suggesting a modern web stack built with Framer Sites and React.

HTTP requests return a 404 status, and the domain is currently offline, limiting direct content analysis. Reputation signals are strongly negative: Google Safe Browsing flags the domain for social engineering, it appears on one security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal reports that 13 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment.

Defenders should block the hostname and its resolved IP at network perimeters, monitor DNS queries for the four authoritative nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), and apply endpoint alerts for any attempt to access URLs matching the observed page title. Threat‑intel feeds should be updated to reflect the domain’s association with Coinbase impersonation and crypto‑scam activity, and incident response teams should advise users to disregard any unsolicited login prompts referencing Coinbase that originate from this or similar subdomains of framer.ai.