cooinbaseproologin[.]wordpress[.]com

This domain, cooinbaseproologin.wordpress.com, is an active credential phishing site targeting users of the Coinbase cryptocurrency exchange. Registered on June 8, 2026, the domain resolves to IP 192.0.78.12, which is associated with WordPress hosting infrastructure. As of July 29, 2026, the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Analysis via VirusTotal indicates that 10 of 91 security vendors flag this domain as malicious, though the specific detection rules or signatures are not disclosed in the available data.

The domain's structure, incorporating 'cooinbaseproologin,' suggests an attempt to mimic the legitimate Coinbase Pro login page, though the exact content and functionality of the site remain unconfirmed. No information is available regarding the phishing kit used, the presence of SSL certificates, or HTTP response codes. The use of a WordPress subdomain may indicate an effort to leverage a reputable platform to evade initial scrutiny, though this tactic is commonly observed in phishing campaigns. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels.

Given its presence on multiple blocklists and detections by security vendors, organizations are advised to update their web filters, email gateways, and endpoint protection tools to include this domain in deny lists. Security teams should also monitor for any internal traffic to this domain, as it may indicate compromised credentials or ongoing phishing attempts. If internal logs reveal connections to this domain, immediate investigation is warranted to assess potential credential theft or unauthorized access to cryptocurrency accounts. No further infrastructure details, such as ASN or hosting provider, are currently available to aid in broader threat hunting.