c0inbase-logi2[.]godaddysites[.]com

The domain c0inbase-logi2.godaddysites.com was registered on 2026-02-21 through GoDaddy.com, LLC and uses the GoDaddy default nameservers cns1.secureserver.net and cns2.secureserver.net. The site resolves to the Amazon Web Services address 13.248.243.5, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. An SSL certificate issued by GoDaddy.com, Inc. (Go Daddy Secure Certificate Authority - G2) is present, confirming the use of a legitimate certificate authority but offering no protection against credential harvesting. HTTP requests return a 404 status, and the site is currently taken offline, as indicated by the “offline” status.

VirusTotal analysis shows that 16 of 95 scanning engines flagged the domain, and three independent security blocklists have listed it. The domain is also blocked by PhishDestroy, MetaMask, and SEAL. The page title observed during the short-lived availability was “Cōinbase Prō Lōgin – Buy & Sell Bitcoin, and more with trust,” indicating an explicit attempt to impersonate the Coinbase brand. The threat is classified as a crypto‑related brand impersonation campaign targeting users of the Coinbase platform.

Defenders should add the IPv4 address 13.248.243.5 to network‑level deny lists, monitor DNS queries for the exact domain and its wildcard variations, and ensure that endpoint protection solutions reference the latest blocklist entries. Because the domain leverages a reputable certificate authority, reliance on TLS validation alone is insufficient; security controls must continue to inspect URL reputation and content signatures. Organizations should educate users about the deceptive page title and reinforce that legitimate Coinbase communications never originate from godaddysites.com subdomains. Ongoing threat‑intel feeds should be consulted to capture any re‑hosting attempts that reuse the same infrastructure.