caoinjbaseroplogi[.]godaddysites[.]com

This domain, caoinjbaseroplogi.godaddysites.com, is identified as a high-risk brand impersonation resource specifically targeting Coinbase, a major digital asset exchange platform. Analysis indicates the site mimics the legitimate Coinbase Pro interface, presenting itself under the title 'Coinbase Pro | Digital Asset Exchange' to deceive users into submitting sensitive credentials or transferring cryptocurrency. No direct evidence of a crypto drainer kit was observed, though the site’s structure and content align with credential theft and fraudulent transaction facilitation typical of such campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, though the phishing content appears to have been deployed more recently. The resource resolves to the IP address 76.223.105.230, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. Google Safe Browsing has flagged the domain as phishing, and 17 out of 95 security vendors on VirusTotal have detected it as malicious. The domain appears on at least one security blocklist, and its SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. As of the latest assessment, the domain has been taken offline, likely in response to detection and reporting by security entities such as PhishDestroy. While the immediate threat has been mitigated, residual risk persists due to the potential for the operators to redeploy the infrastructure or register similar domains. Users who may have interacted with the site are advised to revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Organizations are encouraged to update blocklists to include this domain and its associated IP to prevent future access attempts.