wwwcoinbaseecomsignin[.]wordpress[.]com

The domain wwwcoinbaseecomsignin.wordpress.com is a phishing site engaged in brand impersonation, specifically targeting Coinbase users. It presents itself as the legitimate Coinbase login page to deceive victims into entering cryptocurrency-related credentials, posing an elevated risk of financial theft. No drainer kit was detected, but the site operated as a cryptocurrency scam. As of the latest verification, wwwcoinbaseecomsignin.wordpress.com has been taken offline.

Technical analysis reveals that wwwcoinbaseecomsignin.wordpress.com was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and Kaspersky. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on March 03, 2000, and resolved to the IP address 192.0.78.13, hosted by Automattic, Inc. in the US. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title mimicked Coinbase's branding with slight character alterations. The site used WordPress, MySQL, PHP, and Nginx technologies, and returned an HTTP 410 status when accessed.

Victims of wwwcoinbaseecomsignin.wordpress.com should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to secure their accounts. Monitor for unauthorized transactions or suspicious activity, and report any fraud to Coinbase support. Additionally, users should report the phishing domain to their email provider, browser vendor, or platforms like Google Safe Browsing or PhishTank to aid in blocking future threats.