cooinbasehelppcneter[.]wordpress[.]com

Analysis of cooinbasehelppcneter.wordpress.com, observed as offline (HTTP 410) as of July 24, 2026, indicates that the domain was leveraged for a crypto‑related phishing campaign. The site was hosted on the WordPress.com infrastructure, using ns1‑ns4.wordpress.com as authoritative name servers. Registration was performed through MarkMonitor, Inc., and the domain was originally created on 3 March 2000. The hosting IP resolves to 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States, confirming that the infrastructure is part of the legitimate WordPress service. The TLS certificate is issued by Let’s Encrypt (E8), providing encryption but offering no assurance of legitimacy.

Multiple security services have flagged the domain. VirusTotal reports three detections out of ninety‑five scanners, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist. The page title returned by the server is “Site Title,” but the content of the page has not been captured, and the site currently returns a 410 Gone status, indicating removal of the resource. The technology stack identified includes WordPress, MySQL, PHP, Nginx, HTTP/3, and HSTS, which are consistent with the standard WordPress.com hosting environment.

No evidence of additional malicious payloads or command‑and‑control infrastructure is present in the available data. Uncertainty remains regarding the specific phishing vectors employed before the site was taken offline, as the page content and login forms have not been archived. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the same host or similar subdomains, and incorporate the indicator set (domain name, IP address, name servers, and detection hashes) into threat‑intel feeds. Ongoing observation of the WordPress.