coinbasecointollfree79[.]wordpress[.]com

The domain coinbasecointollfree79.wordpress.com was observed hosting a page titled "Coinbase Toll Free Number 1870 474-4358 ★Coinbase Support Phone ✱Helpline Number | Coinbase Toll Free Number". The site resolved to IP address 192.0.78.12, which belongs to the United States and is announced by AS2635 Automattic, Inc., the operator of the WordPress.com hosting platform. Technical fingerprinting identified WordPress, MySQL, PHP, Nginx, HTTP/3 support and HTTP Strict Transport Security (HSTS) as active components. The TLS certificate was issued by Let’s Encrypt (profile E8), confirming the use of a publicly‑available certificate rather than a brand‑specific one.

Google Safe Browsing flagged the URL for social engineering, and VirusTotal reported that 10 of 95 scanned security vendors marked the domain as malicious. The site appeared on a single blocklist, PhishDestroy, and was also listed by a generic security blocklist. Registration data shows the domain was created on March 03, 2000 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, suggesting the registration may have been compromised or leveraged for abuse. The authoritative nameservers are ns1‑ns4.wordpress.com, consistent with the WordPress.com hosting environment.

The HTTP response code returned 410 (Gone), indicating the content has been removed, and the current status is recorded as offline. The combination of a brand‑specific page title, the use of a reputable hosting provider, a legitimate‑looking TLS certificate, and multiple vendor detections aligns with a high‑risk brand‑impersonation campaign aimed at Coinbase users. Defenders should continue to block the domain at network perimeters, monitor for similar WordPress‑hosted impersonation pages, and advise users to verify support contact information through official Coinbase channels.