conbesspprolloghini[.]godaddysites[.]com

Analysis of conbesspprolloghini.godaddysites.com shows multiple indicators of a high‑risk brand‑impersonation campaign targeting Coinbase. The domain is registered through GoDaddy.com, LLC and uses GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net. It is protected by a Go Daddy Secure Certificate Authority – G2 SSL certificate, which is typical for legitimate GoDaddy‑hosted sites and does not mitigate the malicious intent. The site resolves to IP address 13.248.243.5, an Amazon.com, Inc. (AS16509) host located in the United States. HTTP probing returned a 404 response, and the domain has been taken offline, yet it remains listed on at least one security blocklist and is actively blocked by PhishDestroy.

Google Safe Browsing classifies the URL as social engineering, and VirusTotal reports that 16 of 95 scanners flag the domain as malicious. The page title captured from the site, "Çoinbase Pro | Login | Exchange," explicitly references Coinbase, confirming the impersonation claim. Scamadviser assigns a trust score of 1 out of 100, reinforcing the low credibility of the domain. The intelligence tags the operation as a crypto scam, indicating that any credential collection would likely be used to compromise cryptocurrency accounts.

While the site is currently offline, the infrastructure—GoDaddy registration, Amazon hosting, and a valid SSL certificate—demonstrates a pattern of leveraging reputable services to lend credibility. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurrection of the site on the same IP or hosting provider. Incident response teams should also advise users to verify official Coinbase URLs and avoid entering credentials on any site that does not reside on Coinbase’s verified domains.