koinmarketcap[.]wordpress[.]com

This domain, koinmarketcap.wordpress.com, is currently offline, returning HTTP status 410. The site was identified as a brand‑impersonation campaign targeting Coinbase, with the page title “Coinbase Pro Login– Buy & Sell Bitcoin – Coinbase Pro | Digital Asset Exchange” indicating an attempt to lure victims into a crypto‑related login flow. Infrastructure analysis shows the domain resolves to 192.0.78.13, an address owned by AS2635 Automattic, Inc. in the United States. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate authority.

The hosting stack consists of WordPress, MySQL, PHP, Nginx and HTTP/3, with HSTS enabled, all typical of a WordPress.com‑hosted site. Nameservers ns1‑ns4.wordpress.com are in use, and the domain registration was performed through MarkMonitor, Inc. on March 03 2000. The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports four detections out of ninety‑five scanners, confirming that multiple security vendors have flagged the site as malicious.

The page title and brand target provide the only visible evidence of the intended fraud; no additional content has been captured because the site is no longer reachable. Defenders should continue to block the domain at perimeter and DNS layers, add the IP address to threat‑intel feeds, and monitor for any re‑registration or resurrection under a different subdomain. Given the confirmed impersonation of Coinbase and the presence of a crypto‑drain kit, organizations should also enforce multi‑factor authentication for cryptocurrency platforms and educate users about unsolicited login prompts. Ongoing observation of the associated ASN and registrar can help detect future campaigns that reuse the same infrastructure.