quinbasspro-logz[.]godaddysites[.]com

This domain, quinbasspro-logz.godaddysites.com, is flagged for brand impersonation targeting Coinbase Pro, a cryptocurrency exchange platform. Analysis indicates the page title explicitly mimics the official Coinbase Pro login portal, suggesting an intent to harvest user credentials. The domain does not exhibit direct indicators of a crypto drainer kit but focuses on credential theft through deceptive branding. No associated malware payloads or wallet-draining scripts were identified in initial scans, though further forensic analysis of cached content is recommended. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, though recent malicious activity suggests compromise or repurposing. It resolves to IP address 76.223.105.230, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline. The SSL certificate is issued by GoDaddy Secure Certificate Authority - G2, which does not inherently validate legitimacy due to its widespread use for both legitimate and malicious domains. As of the latest assessment, the domain has been taken offline, likely following abuse reports or hosting provider intervention. Despite its inactive status, residual risk persists due to potential cached pages, historical DNS records, or re-emergence under altered infrastructure. Organizations are advised to monitor for related indicators, including the IP address 76.223.105.230 and the unique seed identifier 5de83c, in network logs. Users who may have interacted with the domain should reset credentials for Coinbase Pro or any other services where identical login details were used. Proactive measures include blocking the domain and IP at perimeter security controls and conducting retrospective analysis for prior connections.