coinnprrobaseloggin[.]wordpress[.]com

Analysis of coinnprrobaseloggin.wordpress.com indicates a credential‑harvesting site that impersonates Coinbase. The site served a page titled "Coinbase pro Login | Buy & Sell Equities In Seconds" before being taken offline, and HTTP response code 410 confirms that the resource is permanently gone. The domain resolves to IP address 192.0.78.12, which belongs to AS2635 Automattic, Inc. and is located in the United States. The hosting infrastructure runs WordPress on Nginx with MySQL and PHP, employs HSTS and HTTP/3, and presents a valid Let's Encrypt certificate (issuer E8).

Nameservers are the standard Wordpress set (ns1‑ns4.wordpress.com). Registration records show the domain was created on March 03, 2000 and managed through MarkMonitor, Inc., a registrar often associated with brand‑owner protection services. VirusTotal scans have flagged the domain in nine of ninety‑five security engines, indicating malicious behavior, and the domain appears on at least one security blocklist. PhishDestroy has also listed the site as blocked, reinforcing the classification as a crypto‑related scam.

The combination of a brand‑specific page title, the presence of multiple detection vendor alerts, and active blocklist listings provide concrete evidence that the domain was used for brand impersonation targeting Coinbase users. While the site is currently offline, defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host or similar subdomains, and maintain awareness of related phishing campaigns that reference Coinbase. Ongoing vigilance is recommended because the underlying infrastructure (WordPress on shared hosting) can be re‑used to launch new impersonation pages with minimal effort.