c0inbasepr0l0gin1n[.]wordpress[.]com

Analysis of c0inbasepr0l0gin1n.wordpress.com, observed on July 24 2026, indicates that the site was actively used for a Coinbase brand‑impersonation campaign. The page title returned by the server, “Còinbase Prò Lògin – Digital Assets Exchange,” mirrors the legitimate Coinbase branding and aligns with the recorded scam type of a crypto scam. The domain resolves to IP 192.0.78.13, which belongs to AS2635 Automattic, Inc., a US‑based hosting provider for WordPress.com. The site was served over HTTPS using a Let’s Encrypt certificate (E8), and the HTTP response code is 410, signalling that the resource has been removed; the current status is listed as offline. Infrastructure details show the domain was created on 2000‑03‑03 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may be an attempt to lend credibility.

Nameservers ns1‑ns4.wordpress.com further confirm hosting on the WordPress platform. Detected technologies include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, matching the typical stack of a WordPress site. The domain appears on one security blocklist, PhishDestroy, and VirusTotal reports eight of ninety‑five scanners flagging the host as malicious. No additional public threat‑intel sources are cited in the supplied data.

Uncertainty remains regarding the content that was served before the 410 response, as the page has been taken offline and no screenshots or HTML captures are provided. The exact phishing kit or credential‑harvesting mechanism cannot be confirmed without further artefact analysis. Defenders should continue to block the domain at perimeter filters, update URL and domain reputation lists with the observed IP address and host name, and monitor for any future re‑registration of the same second‑level domain or similar look‑alike variations.