login-coinbase-wallet[.]blogspot[.]com

This domain, login-coinbase-wallet.blogspot.com, is flagged as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics the legitimate Coinbase Wallet login interface, likely designed to harvest user credentials or facilitate unauthorized access to cryptocurrency accounts. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and page title align with credential theft campaigns commonly used as a precursor to financial fraud or account takeover attacks. Infrastructure analysis reveals the following technical indicators: the domain is hosted on an IPv6 address (2607:f8b0:4004:c21::84) associated with Google LLC (AS15169), a common hosting provider for both legitimate and malicious subdomains. The domain was originally registered on July 31, 2000, through MarkMonitor, Inc., though the subdomain itself appears to be a recent creation. Google Safe Browsing explicitly flags the domain as phishing, and it appears on at least one security blocklist. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing, brand impersonation, and social engineering categories. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to its widespread use across both benign and malicious sites. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual threats remain, including potential reuse of the infrastructure for future campaigns or the existence of cloned variants. Users who may have interacted with the domain are advised to rotate credentials immediately, enable multi-factor authentication on all financial and cryptocurrency accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate logs for prior connections to the domain or its hosting provider. The use of a blogspot subdomain underscores the need for heightened scrutiny of third-party hosting platforms in credential theft campaigns.