coinbasseprologi8[.]wordpress[.]com

Analysis of coinbasseprologi8.wordpress.com shows a domain that has been taken offline but retains multiple indicators of malicious intent. The site returned an HTTP 410 Gone status, confirming that the content has been removed, yet the underlying infrastructure remains observable. The domain resolves to IP 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States, a host commonly used for legitimate WordPress.com blogs. Despite the legitimate hosting environment, the page title returned by the server is "WordPress.com — Get a Free Blog Here," a generic title that does not reveal any phishing payload but is consistent with a placeholder or abandoned blog page. Security telemetry adds weight to the suspicion: VirusTotal recorded eight detections out of ninety‑five scanners, and Google Safe Browsing flags the domain for social engineering.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing the classification as a phishing vector. Registration details show the domain was created on 3 March 2000 and was registered through MarkMonitor, Inc., a registrar often used for high‑value brands, suggesting potential abuse of a long‑standing namespace. The SSL certificate is issued by Let’s Encrypt (E8), providing HTTPS encryption but offering no assurance of legitimacy. Detected technologies include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, all typical of a standard WordPress installation. Nameservers are the default ns1‑ns4.wordpress.com set, indicating no custom DNS configuration.

The combination of a generic blog title, multiple vendor detections, Safe Browsing flag, and blocklist inclusion points to a confirmed phishing site, even though the content is currently unavailable. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intelligence feeds with the observed indicators, and monitor the IP address for any re‑use.