proencoinprotal[.]wordpress[.]com

Analysis of proencoinprotal.wordpress.com shows a confirmed brand‑impersonation campaign targeting Coinbase users. The site presented the page title "Coinbase Pro Login| Trade Bitcoin & Crypto Safely", indicating a crypto‑focused credential‑harvesting attempt. Infrastructure details reveal the domain resolves to 192.0.78.12, an IP owned by Automattic, Inc. (AS2635) located in the United States, and is served by a WordPress stack that includes MySQL, PHP, Nginx, HSTS and HTTP/3. The site employed a Let’s Encrypt certificate (E8) and used the standard WordPress nameservers ns1‑ns4.wordpress.com.

Registration was handled through MarkMonitor, Inc., a legitimate registrar, and the domain’s creation date is listed as March 03 2000, suggesting the domain was repurposed for malicious use rather than newly registered. VirusTotal scans returned nine positive detections out of ninety‑five scanners, reinforcing the malicious classification. The domain has been added to at least one public blocklist and is currently blocked by PhishDestroy.

HTTP responses now return a 410 Gone status, and the site is reported as taken offline. Defenders should continue to enforce blocking of the IP address and domain at perimeter defenses, monitor for any re‑registration attempts, and incorporate the domain hash into threat‑intel feeds. Additional vigilance is advised for any inbound traffic referencing Coinbase login URLs, especially those that match the observed page title or use similar WordPress‑based hosting patterns, as attackers may recycle the infrastructure under new subdomains or domains.