deepbookai[.]com

This domain, deepbookai.com, is flagged as a brand impersonation phishing campaign targeting users of the GoDaddy platform. Analysis indicates the site was designed to mimic legitimate GoDaddy login or account management portals, likely to harvest credentials or facilitate unauthorized account access. No crypto drainer kit signatures were observed, but the presence of HSTS and OpenResty suggests an attempt to appear legitimate while concealing malicious intent. The domain does not exhibit overt financial fraud indicators but aligns with credential theft tactics commonly employed in targeted phishing operations.

Infrastructure analysis reveals the domain was registered on February 05, 2025, through Dynadot LLC, a registrar frequently associated with phishing and abuse. It resolves to the IP address 23.56.162.17, which has no prior association with GoDaddy’s official infrastructure. Detection metrics show 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two independent security blocklists. The domain’s SSL certificate, issued by Let’s Encrypt, is valid but does not mitigate its fraudulent purpose. Technologies detected include Nginx and OpenResty, which are often leveraged to obfuscate backend operations and evade detection.

As of the latest assessment, deepbookai.com has been taken offline, likely in response to abuse reports or automated takedown mechanisms. However, the elevated risk level persists due to the domain’s recent registration and the potential for re-emergence under a different name or IP. Users who may have interacted with the site are advised to reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its resolving IP to prevent future access attempts.