conbasesprologinuk[.]wordpress[.]com

On July 24, 2026, analysts observed that conbasesprologinuk.wordpress.com resolved to the IP address 192.0.78.12, which is owned by Automattic, Inc. (AS2635) and located in the United States. The domain is hosted on a WordPress stack that includes MySQL, PHP, Nginx, HSTS, and HTTP/3, and it presents a TLS certificate issued by Let’s Encrypt (E8). HTTP probing returned a 410 Gone status, indicating that the content has been removed, and the site is currently reported as offline. The page title retrieved from historic snapshots reads "Cóinbase Pro Login | Sign in Now – Digital Asset Exchange," directly referencing the Coinbase Pro brand and suggesting a credential harvesting campaign targeting cryptocurrency traders.

Registration data shows the domain was created on March 03, 2000 and is managed through MarkMonitor, Inc., with standard WordPress nameservers (ns1-4.wordpress.com). VirusTotal analysis recorded nine detections out of ninety‑five scanned scanners, and the domain appears on one external security blocklist. PhishDestroy has confirmed the site as blocked, and intelligence tags the activity as a crypto‑related credential phishing attempt.

While the offline status limits immediate exposure, the combination of brand impersonation, active SSL, and historical detection by multiple vendors indicates a persistent threat infrastructure. Defenders should continue to block the domain at network perimeter devices, monitor DNS resolutions for the associated IP range, and update URL filtering lists to include this hostname. Additionally, organizations should educate users about unsolicited login prompts referencing Coinbase Pro and enforce multi‑factor authentication for cryptocurrency platforms to mitigate credential compromise.