signincoinbasecom[.]wordpress[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. The infrastructure is designed to mimic legitimate login portals, likely to harvest credentials or facilitate unauthorized account access. Analysis indicates the domain operates under the guise of a free blog service, a common tactic to evade initial suspicion while hosting malicious content. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 192.0.78.13, hosted on AS2635 (Automattic, Inc) in the United States. It was registered on March 03, 2000, through MarkMonitor, Inc., though the subdomain’s malicious activity is recent. The SSL certificate is issued by Let’s Encrypt (serial number E8), a detail often exploited by threat actors to appear legitimate. The domain is detected by 9 out of 95 security vendors on VirusTotal, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'WordPress.com — Get a Free Blog Here,' further confirms the use of a free hosting service to obscure its true intent. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (192.0.78.13) at the network level. Users who may have interacted with the domain should reset their Coinbase credentials and enable multi-factor authentication (MFA) on all accounts. Organizations should update their email and web filtering rules to include this domain and its subdomains, as well as monitor for similar patterns (e.g., 'signin[brand]com.wordpress.com'). Given the domain’s presence on multiple blocklists, security teams should cross-reference internal logs for any prior connections to this infrastructure. If credentials were entered, affected accounts should be reviewed for unauthorized transactions or configuration changes.