coinbaseelogin[.]blogspot[.]mk

The domain coinbaseelogin.blogspot.mk is actively hosting a credential‑stealing page that targets Coinbase users, as indicated by the page title "Coinbase Login | Jump Start Your Crypto Portfolio" and the classification of a crypto scam. Infrastructure analysis shows the domain resolves to IP 142.251.111.132, owned by Google LLC (AS15169) in the United States, and uses a Google Trust Services / WE2 SSL certificate. The site is built on Blogger and incorporates Java, Python, OpenGSE, Google Analytics, Clipboard.js, and HTTP/3, with a HTTP 302 redirect observed. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING, Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 11 of 95 security vendors flagging the domain. The domain is listed on one security blocklist, has been blocked by PhishDestroy, and was registered through UNET-REG. While the exact page content beyond the title has not been examined, the convergence of branding, technical indicators, and multiple threat feeds confirms a high‑risk credential‑phishing operation. Defenders should block the domain at network and endpoint layers, monitor DNS queries for the associated IP and nameserver (blogspot.l.googleusercontent.com), and educate users to avoid unsolicited Coinbase login prompts. Continuous threat‑intel updates are recommended to track any changes in hosting or payload delivery.