ukcoiinbseprolozisg[.]godaddysites[.]com

The domain ukcoiinbseprolozisg.godaddysites.com is identified as a brand-impersonation threat targeting Base, a cryptocurrency platform. Analysis confirms this domain hosted a fraudulent Coinbase Pro login page designed to harvest user credentials. The site is currently offline, but prior activity indicates elevated risk due to its deceptive imitation of a legitimate financial service. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered through GoDaddy.com, LLC, and resolved to the IP address 76.223.105.230, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain creation date of November 18, 2013, predates the phishing activity, suggesting it may have been repurposed for malicious use. The site appeared on one security blocklist, and its SSL certificate was issued by GoDaddy.com, Inc., a common certificate authority for both legitimate and fraudulent domains. The page title, 'Çoinbase Pro Login | Official Website,' further confirms its intent to deceive users by impersonating the legitimate Coinbase Pro platform. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential vector for future phishing campaigns. Organizations and individuals are advised to block the domain and its associated IP address (76.223.105.230) at the network level. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the exposure window. Monitoring for similar domains using variations of 'coinbase' or 'base' is recommended to mitigate future threats. Security teams should review logs for connections to the domain or IP to assess potential compromise.