coinbaseelogin[.]blogspot[.]com[.]au

This domain is flagged as an elevated-risk brand impersonation site specifically designed for credential theft targeting Coinbase users. Analysis indicates the infrastructure was constructed to mimic legitimate Coinbase login portals, likely to harvest cryptocurrency account credentials or facilitate unauthorized transactions. The page title, 'Coinbase Login | Jump Start Your Crypto Portfolio,' directly mirrors Coinbase's branding, increasing the likelihood of successful deception among users seeking to access their accounts. Infrastructure analysis reveals the domain coinbaseelogin.blogspot.com.au resolved to IP address 142.251.221.65, a Google-hosted endpoint commonly associated with Blogspot properties. The domain was registered through MarkMonitor, Inc., a registrar frequently utilized by legitimate enterprises, which may have initially obscured its malicious intent. Security vendors on VirusTotal detected the domain, with 13 out of 95 flagging it as malicious. Additionally, the domain appears on at least one security blocklist, further corroborating its classification as a threat. The SSL certificate, issued by Google Trust Services (WE2), aligns with standard Blogspot domains, providing a false sense of security to end users. To mitigate the risk of credential theft, users who may have interacted with this domain should immediately reset their Coinbase account passwords and enable multi-factor authentication (MFA) using an authenticator app or hardware key. Financial institutions and cryptocurrency platforms should proactively monitor for unauthorized login attempts or transactions originating from this domain or associated IP addresses. Organizations should also update their email and web filtering rules to block access to coinbaseelogin.blogspot.com.au and similar impersonation domains. Users are advised to verify the legitimacy of login pages by inspecting the URL and ensuring it matches the official domain (coinbase.com) before entering any credentials.