login-coinbase-wallet[.]blogspot[.]be

The domain login-coinbase-wallet.blogspot.be is presently active and serves a credential‑collection site targeting Coinbase users. The page title observed is “Login Coinbase Wallet”, and Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category. VirusTotal reports that 10 of 95 scanned security vendors flag the domain as malicious. Infrastructure analysis shows the domain resolves to 142.250.186.161, an IP owned by Google LLC (ASN 15169) located in the United States. The site is hosted on Google’s Blogger platform, as indicated by the detected technology stack (Blogger, Java, Python, OpenGSE, HTTP/3) and the use of Google’s nameservers ns1‑ns4.google.com. The SSL certificate is issued by Google Trust Services under the WE2 chain, confirming the use of a legitimate Google‑managed TLS certificate. Registration metadata indicates the domain was created on 1 February 2003 and was registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. Despite the legitimate registrar and TLS certificate, the domain appears on one public blocklist and has been blocked by PhishDestroy. The HTTP response is a 302 redirect, but the final landing page content has not been captured, leaving the exact visual content and login flow unverified. Defenders should block or sinkhole the domain at the network perimeter and add it to phishing detection rules. Email gateways and web proxies should treat any URL containing login-coinbase-wallet.blogspot.be as malicious, especially when the context involves cryptocurrency or wallet access. Continuous monitoring of the IP address 142.250.186.161 for other suspicious domains is advised, and incident response teams should audit any authentication attempts that reference this domain for possible credential compromise.