coinjbaseprozlogiii[.]godaddysites[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Coinbase users through a fraudulent login portal. Analysis indicates the infrastructure was designed to mimic Coinbase Pro, a digital asset exchange platform, with the intent to harvest credentials or facilitate unauthorized transactions. The specific threat type is a fake login page, leveraging brand recognition to deceive victims into entering sensitive account details. Infrastructure analysis reveals the domain coinjbaseprozlogiii.godaddysites.com was registered through GoDaddy.com, LLC on November 18, 2013, though the phishing content appears to have been deployed recently. The domain resolves to the IP address 76.223.105.230 and is associated with a GoDaddy-issued SSL certificate. Security vendors on VirusTotal flagged the domain with 13 detections out of 95, while Scamadviser assigned a trust score of 1 out of 100. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was actively blocked prior to being taken offline. The page title, 'Coinbase Pro | Digital Asset Exchange,' further confirms the intent to impersonate the legitimate platform. Mitigation steps for this type of threat include immediate verification of domain authenticity before entering credentials, particularly for cryptocurrency exchanges. Users should cross-reference URLs with official sources and avoid accessing financial platforms through links in unsolicited communications. Organizations should update blocklists to include this domain and its associated IP, while monitoring for similar typosquatting or brand-impersonation attempts. Security teams are advised to conduct retrospective analysis of logs for connections to 76.223.105.230 or related infrastructure, as the domain may resurface under a different guise. Enabling multi-factor authentication on all financial accounts adds an additional layer of protection against credential theft.