coinbaseprologin1usa[.]wordpress[.]com

On July 24, 2026, an investigation was conducted on the domain coinbaseprologin1usa.wordpress.com, which has been flagged for brand impersonation. The domain impersonates Coinbase, a well-known digital asset exchange, and was taken offline at the time of the report. The page title found was 'Cóínbase Pro Ĺoġin | Digital Asset Exchange,' which closely mimics the legitimate Coinbase Pro login page, suggesting an intent to deceive users into believing they are accessing a genuine Coinbase service. The domain was registered through MarkMonitor, Inc., and created on March 03, 2000, indicating a significant age that could be leveraged for credibility or as part of a recycled domain strategy.

Infrastructure analysis reveals that the domain resolves to the IP address 192.0.78.13, located in the United States and associated with AS2635 Automattic, Inc. The domain uses a Let's Encrypt SSL certificate, which is common among both legitimate and malicious sites, but may lend an air of authenticity to unsuspecting visitors. The domain has been flagged by 8 of 95 security vendors on VirusTotal, and it appears on one security blocklist, including being blocked by PhishDestroy. Google Safe Browsing has also flagged the domain for social engineering, further corroborating the risk of brand impersonation. The HTTP status code 410 indicates that the resource is no longer available, which is consistent with the domain being taken offline.

The technologies detected on the site include WordPress, MySQL, PHP, Nginx, HSTS, and HTTP/3, suggesting a sophisticated web infrastructure. Defenders should remain vigilant and monitor for any reactivation of the domain. Users should be educated to verify URLs and use official channels for accessing Coinbase services to avoid potential compromise. Despite the current offline status, the historical flags and known scam type indicate a high likelihood of previous malicious activity, and the domain should be treated with caution.