coiinbase-logiin[.]blogspot[.]qa

The domain coiinbase-logiin.blogspot.qa has been identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. This infrastructure was designed to deceive users into believing they were interacting with legitimate Coinbase services, specifically through a fraudulent page titled 'How do I buy Bitcoin on Coinbase?' The domain is currently offline, but prior activity indicates a deliberate attempt to harvest credentials or mislead users into unauthorized transactions.

Analysis of the domain reveals critical technical indicators. The domain was registered through Google LLC and resolved to the IP address 172.217.20.129, associated with Google’s autonomous system (AS15169). It was flagged by 9 of 95 security vendors on VirusTotal, including detections from PhishDestroy, MetaMask, and SEAL. Google Safe Browsing explicitly labeled the domain as phishing. The SSL certificate, issued by Google Trust Services (WE2), does not mitigate the malicious intent, as the domain appeared on three independent security blocklists. The creation date of February 21, 2026, suggests either a typo-squatted or lookalike domain intended to exploit user trust in the Coinbase brand.

The current status of coiinbase-logiin.blogspot.qa is offline, likely due to takedown efforts or suspension by the hosting provider. However, the infrastructure demonstrates a persistent threat vector for brand impersonation in the cryptocurrency sector. Organizations and users are advised to monitor for similar domains using homoglyphs or slight misspellings of legitimate platforms. Network defenders should update blocklists to include this domain and its associated IP address. End-users should verify domain authenticity before entering credentials and enable multi-factor authentication on all cryptocurrency-related accounts. Incident responders are encouraged to review logs for connections to 172.217.20.129 or related subdomains to identify potential compromise.