coinbase-login[.]blogspot[.]ca

Analysis indicates that coinbase-login.blogspot.ca is an active brand impersonation domain targeting Coinbase users. The domain was registered on October 18, 2006, through MarkMonitor, Inc., and is hosted on Google LLC infrastructure (AS15169) in Germany, resolving to IP 216.58.206.65. The page title explicitly displays 'Coinbase Login,' and the domain is classified under the scam type 'cryptocurrency.' Google Safe Browsing has flagged this domain with the label 'SOCIAL_ENGINEERING,' and it appears on one security blocklist. Infrastructure analysis reveals the use of Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3 technologies, with an SSL certificate issued by Google Trust Services (WE2). The domain currently returns an HTTP 302 status, suggesting a redirect mechanism, though the final destination remains unconfirmed. VirusTotal reports that 11 out of 93 security vendors flag this domain as malicious, reinforcing its high-risk classification. Defenders should treat this domain as an active threat, block access, and monitor for related phishing campaigns targeting cryptocurrency users. The exact content and functionality of the site have not yet been analyzed, but the combination of brand impersonation, social engineering flags, and cryptocurrency scam classification warrants immediate mitigation.