coinbaselogine[.]blogspot[.]co[.]za

This domain, coinbaselogine.blogspot.co.za, is flagged as a high-risk brand impersonation site targeting Coinbase users. Analysis indicates the page title explicitly presents itself as 'Coinbase Login | Digital Asset Exchange - Buy & Trade Now,' directly mimicking the official Coinbase login portal. The domain is hosted on Blogger infrastructure, resolving to IP address 142.250.186.97, and uses an SSL certificate issued by Google Trust Services, which may lend a superficial appearance of legitimacy to unsuspecting visitors. Infrastructure analysis reveals the domain was created on February 24, 2005, though this long registration history does not correlate with its current malicious use. The domain is detected by 10 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, including PhishDestroy. Technologies detected include Java, Python, OpenGSE, and Clipboard.js, alongside HTTP/3 support, which may be leveraged to evade detection or facilitate data exfiltration. While the domain remains active as of July 12, 2026, the exact mechanics of the phishing operation—such as whether credentials are harvested in real-time or redirected to another endpoint—are not yet confirmed. The use of a subdomain under blogspot.co.za suggests an attempt to exploit the reputation of a legitimate platform to bypass initial scrutiny. Defenders should treat this domain as a confirmed impersonation threat and prioritize blocking or monitoring access to it. Organizations are advised to update filtering rules to include this domain and its resolving IP address. End-user awareness should emphasize verifying the authenticity of login pages, particularly when accessing financial or cryptocurrency platforms. Further investigation into associated infrastructure, such as redirect chains or backend servers, may provide additional indicators for broader threat mitigation.