logincoinbasewallet[.]blogspot[.]co[.]nz

Analysis indicates the domain logincoinbasewallet.blogspot.co.nz was registered on 12 May 2026 and currently resolves to IP 142.251.127.132, a Google‑owned address located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE2 designation, confirming that the underlying infrastructure is hosted on Google Cloud services. The HTTP response is a 302 redirect, and the page title returned is "Coinbase", matching the declared impersonation of the Coinbase brand. Security telemetry shows the domain is listed on three blocklists, flagged by safe‑browsing services as "SOCIAL_ENGINEERING", and receives a Gridinsoft trust score of 0 out of 100. VirusTotal scans report that 11 of 92 antivirus engines flagged the host, reinforcing a high‑confidence malicious classification. The observed activity aligns with credential‑phishing behavior targeting Coinbase users. At present, no additional content has been disclosed, and the specific phishing kit or page layout remains unverified. Defenders should immediately block the domain at DNS and proxy layers, add the IP address to network deny lists, and monitor outbound connections to Google‑owned IP ranges for anomalous redirects. Email gateways should be tuned to reject messages containing the domain or similar "logincoinbasewallet" patterns. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure.