coinbasel0ginpro[.]wordpress[.]com

Analysis of coinbasel0ginpro.wordpress.com shows it was deliberately created to impersonate Coinbase, as indicated by the page title "Cõinbâse Prô Login – The Best Place To Buy, Sell, And Pay" and the explicit brand target of Coinbase. The domain resolves to IP 192.0.78.12, which belongs to the AS2635 Automattic, Inc. network in the United States and is served by the standard WordPress nameservers ns1‑ns4.wordpress.com. The site employed a Let’s Encrypt/E8 certificate, offered HSTS and HTTP/3, and was built on a typical WordPress stack comprising MySQL, PHP and Nginx. HTTP response code 410 confirms that the content has been removed, and the site’s status is recorded as offline.

Registration details list MarkMonitor, Inc. as the registrar, and the domain’s creation date is March 03, 2000. Threat intelligence indicates that the domain was flagged by PhishDestroy and appears on one security blocklist. VirusTotal scans reported ten detections out of ninety‑five vendors, reinforcing the malicious classification.

While the hosting environment appears legitimate, the combination of brand impersonation, crypto‑scam categorisation, and multiple vendor detections demonstrates a clear risk. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the subdomain, and update endpoint protection rules to reflect the ten VirusTotal detections. Because the site is currently offline, any active exploitation is unlikely, but the infrastructure could be repurposed; therefore, ongoing vigilance and inclusion of the domain in threat‑intel feeds are recommended.