coiinbase-logiin[.]blogspot[.]is

This domain is flagged as a high-risk brand impersonation site specifically targeting Coinbase, a major cryptocurrency exchange platform. The site employs deceptive tactics to mimic legitimate Coinbase login and transaction pages, aiming to harvest user credentials or facilitate unauthorized crypto asset transfers. The threat type is classified as brand impersonation with potential credential theft and crypto drainer functionality, based on the page title and known attack patterns associated with similar domains. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain coiinbase-logiin.blogspot.is was created on February 21, 2026, and is hosted on Google LLC infrastructure (AS15169) with an IP resolution of 142.251.141.65. It is registered through Google LLC and uses an SSL certificate issued by Google Trust Services (WE2). The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by Google Safe Browsing as phishing. VirusTotal reports 10 out of 95 security vendors detecting this domain as malicious, with detections specifically noting brand impersonation and credential theft behaviors. Mitigation steps for this threat type include immediate domain takedown requests to the hosting provider and registrar, along with blacklisting the domain across security gateways and endpoint protection systems. Organizations should implement strict domain similarity detection rules to block typosquatting variants targeting financial services brands. Users who may have interacted with this domain should reset credentials for any associated accounts, enable multi-factor authentication, and monitor transaction histories for unauthorized activity. Security teams are advised to correlate this domain with other known Coinbase impersonation campaigns to identify broader attack infrastructure patterns.