coinbasseprolog6[.]wordpress[.]com

On July 25, 2026 analysts observed that coinbasseprolog6.wordpress.com is a newly registered sub‑domain created on February 21, 2026 and hosted on the WordPress.com platform. DNS resolution points to IP 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States. The site presented a TLS certificate issued by Let’s Encrypt (identifier E8), indicating standard HTTPS encryption but offering no additional trust beyond the certificate authority. The HTTP response returned a 410 Gone status, confirming that the content has been removed and the domain is currently offline. The page title captured from the site – “Coinbase Pro Login® | Manage Your Crypto® – Coinbase Pro Login® | Manage Your Crypto®” – directly references Coinbase’s branding, satisfying the classification of brand impersonation and crypto‑scam activity.

Google Safe Browsing flagged the URL for social engineering, and eight of ninety‑three VirusTotal scanners reported detections, reinforcing the malicious intent. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple defense layers have identified it as a threat. Technical profiling identified a typical WordPress stack: Nginx front‑end, PHP back‑end, MySQL database, with HTTP/3 support and HSTS enforced. Nameserver delegation to ns1‑ns4.wordpress.com further confirms the use of the official WordPress hosting service.

No additional indicators such as malicious payloads, redirects, or credential‑stealing scripts were captured beyond the page title. Given the high‑risk rating, defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP and SSL fingerprint to threat‑intel feeds. Continuous observation of the underlying WordPress hosting environment is advised, as compromised accounts on shared platforms can be reused for future impersonation campaigns.