coinbaseprolog1[.]wordpress[.]com

This domain, coinbaseprolog1.wordpress.com, was registered through Automattic Inc. on February 21, 2026 and resolves to the IP address 192.0.78.13, which belongs to AS2635 Automattic, Inc. in the United States. The site is built on a standard WordPress stack, indicated by the presence of WordPress, MySQL, PHP, Nginx, HSTS and HTTP/3, and is served with a Let’s Encrypt E8 certificate. The HTTP response code returned 410, confirming that the content has been removed, and the domain is currently listed as offline. The page title captured during scanning reads “Coinbase Pro Login® || Trade Digital Assets Securely,” directly referencing the Coinbase brand and matching the classified scam type of a crypto scam.

Google Safe Browsing flags the URL for social engineering, and one security blocklist has added it to its watchlist. VirusTotal analysis shows that eight of ninety‑three scanners flagged the domain, and PhishDestroy has already blocked it. The only observed nameserver is lb.wordpress.com.

While the technical footprint confirms a typical WordPress hosting environment and the branding in the title, the actual page content has not been captured beyond the title, leaving the exact phishing payload unknown. Defenders should immediately add coinbaseprolog1.wordpress.com to URL filtering and domain blocklists, monitor for new subdomains under the wordpress.com hosting provider that use similar “coinbasepro” naming patterns, and incorporate the observed indicator set (IP 192.0.78.13, SSL issuer Let’s Encrypt, HTTP 410) into network detection rules. Continuous feed updates from Google Safe Browsing, VirusTotal, and PhishDestroy are recommended to capture any resurgence of this infrastructure.