cnbasprologiusaa[.]godaddysites[.]com

This domain, cnbasprologiusaa.godaddysites.com, is actively flagged as a high-risk crypto phishing site targeting Coinbase Pro users. Infrastructure analysis reveals the domain is hosted on Amazon Web Services (AS16509) with the IP address 76.223.105.230, located in the US. The domain was created on November 18, 2013, but its current malicious activity is recent, as indicated by its presence on one security blocklist and a Gridinsoft trust score of 0/100. The page title explicitly displays 'Çoinbase Pro Login,' strongly suggesting an intent to impersonate the legitimate Coinbase Pro platform for credential harvesting or crypto theft. The domain is built using GoDaddy Website Builder, a common platform for both legitimate and fraudulent sites, and employs additional technologies such as RequireJS and Re:amaze, which may be used for dynamic content loading or customer interaction. The SSL certificate is issued by GoDaddy, providing a superficial layer of legitimacy, but this is not uncommon for phishing sites attempting to evade basic security warnings. The domain resolves to nameservers under secureserver.net, consistent with GoDaddy-managed infrastructure. Defenders should treat this domain as an active threat. The combination of a Coinbase Pro-themed page title, a zero trust score, and its presence on a security blocklist provides sufficient evidence for immediate blocking or monitoring. While the exact content and functionality of the site remain unanalyzed, the infrastructure and known indicators align with typical crypto phishing campaigns. No further scanning or detection data (e.g., from VirusTotal) is available to confirm additional vendor classifications, but the existing evidence justifies proactive mitigation. Organizations should prioritize alerting users, updating web filters, and investigating any potential exposure or credential leaks associated with this domain.