coinbasewithdrawallimit8[.]wordpress[.]com

The domain coinbasewithdrawallimit8.wordpress.com was observed as a brand‑impersonation site targeting Coinbase users. The site is registered through MarkMonitor, Inc. and was created on March 03, 2000. Infrastructure analysis shows the domain resolves to IP address 192.0.78.12, which belongs to AS2635 Automattic, Inc. and is geolocated in the United States. The hosting stack consists of WordPress, MySQL, PHP, Nginx with HSTS and HTTP/3 enabled, indicating a standard WordPress deployment on the WordPress.com platform.

The domain’s SSL certificate is issued by Let’s Encrypt (E8) and the authoritative nameservers are ns1‑ns4.wordpress.com. The site returned HTTP status code 410, confirming that the content has been removed, and the current operational status is listed as offline. Security intelligence places the domain on one public blocklist and it is also flagged by PhishDestroy. VirusTotal recorded four detections out of ninety‑five scanning engines, providing additional corroboration of malicious activity.

The page title returned by the server is “Site Title,” and the domain explicitly claims to impersonate Coinbase, aligning with the classified crypto‑scam threat type. While the exact page content has not been captured, the combination of brand impersonation, the presence on blocklists, multiple vendor detections, and the Crypto Scam label indicates a high likelihood of phishing or credential‑harvesting activity. Defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any resurgence. Incident responders should investigate logs for connections to 192.0.78.12 and consider issuing detection signatures for the observed TLS fingerprint and HTTP 410 response pattern.