coinbase-wallet-login-to[.]blogspot[.]jp

Analysis of the domain coinbase-wallet-login-to.blogspot.jp indicates active brand impersonation targeting Coinbase users, classified as a high-risk crypto scam. The domain was registered on February 21, 2026, through Google LLC and is hosted on Blogger infrastructure, resolving to IP address 142.251.141.97, which belongs to Google LLC (AS15169) in the United States. The site returns an HTTP 302 redirect status, a technique often used to obscure the final destination or to evade detection by automated scanners. The page title explicitly reads 'Coinbase Wallet Login,' confirming the intent to mimic the legitimate Coinbase login interface.

Detection data reveals that 12 of 93 security vendors on VirusTotal flag this domain as malicious, while Google Safe Browsing categorizes it as social engineering. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Nameservers are hosted under Google’s infrastructure (ns1.google.com through ns4.google.com), and the SSL certificate is issued by Google Trust Services, consistent with Blogger-hosted domains. Technologies detected include Java, Python, OpenGSE, and HTTP/3, which align with standard Blogger backend components rather than a custom phishing kit.

While the domain remains active as of July 23, 2026, defenders should treat it as confirmed malicious infrastructure. Organizations are advised to block the domain at the DNS or proxy level, update endpoint protection signatures, and alert users to the risk of credential theft or cryptocurrency fraud. The use of a Google-owned subdomain and hosting provider complicates takedown efforts, requiring coordination with the registrar. No evidence suggests this domain is part of a broader campaign beyond the Coinbase impersonation, though the HTTP 302 redirect may indicate additional malicious endpoints not yet analyzed.