# PhishDestroy threat dossier — coinbaseloggin.blogspot.com.mt ================================================================ Fetched: 2026-07-22 15:14:04 UTC Canonical: https://phishdestroy.io/domain/coinbaseloggin.blogspot.com.mt/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation Targeted brand: Coinbase ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Emsisoft, Fortinet, Kaspersky, LevelBlue, Lionic, Netcraft, Sophos, Webroot URLQuery: -1 detections Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 192.178.183.132 (US, Mountain View) ASN: AS15169 Google LLC Hosting org: Google LLC Registrar: Google Blogger Registered: 2026-05-25 Page title: Blog nicht gefunden. HTTP response: 302 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE2 Expires: 2026-09-14 Status: INVALID chain Fingerprint: dfa3f8ab89d00806a0e01ae992c457435d332b448a420a98535c94e570e0fa17 Subject Alternative Names (related infrastructure — often same operator): - blogspot.ae - blogspot.al - blogspot.am - blogspot.ba - blogspot.be - blogspot.bg - blogspot.ca - blogspot.ch - blogspot.cl - blogspot.co.at - blogspot.co.id - blogspot.co.il - blogspot.co.ke - blogspot.co.nz - blogspot.co.uk ... +55 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-26 05:30:12 UTC (by PhishDestroy tracker) First reported: 2026-06-15 03:47:21 UTC (abuse notice filed) Last verified: 2026-07-22 16:20:37 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-18 16:50:19 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] coinbaseloggin.blogspot.com.mt Fake Coinbase Alert The domain coinbaseloggin.blogspot.com.mt was identified as a brand impersonation threat specifically targeting Coinbase, a popular cryptocurrency exchange. This phishing domain is designed to trick users into entering their login credentials, potentially leading to account compromise and theft of digital assets. As of the latest assessment, the domain is offline, having been taken down after security researchers flagged its malicious activity. Technical indicators reveal that the domain was created on May 25, 2026, and appears on three security blocklists. VirusTotal data shows that 15 out of 95 security vendors flagged this domain as malicious, indicating a strong consensus on its dangerous nature. The domain impersonates Coinbase, using a deceptive subdomain 'coinbaseloggin' to mimic the legitimate login page. The risk level was assessed as high due to the targeted nature of the attack and the potential financial impact on victims. Given that the domain is now offline, users who may have encountered it prior to takedown should take immediate action. If any credentials were entered on this fake page, users must change their Coinbase passwords and enable two-factor authentication. It is also advisable to monitor accounts for unauthorized transactions. For future safety, always verify the legitimacy of login pages by checking the URL carefully and using official bookmarks. PhishDestroy provides real-time verification tools to help users avoid such threats. Stay vigilant against phishing attempts that exploit trusted brands like Coinbase. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: dfa3f8ab89d00806a0e01ae992c457435d332b448a420a98535c94e570e0fa17 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/coinbaseloggin.blogspot.com.mt/ JSON API: https://api.destroy.tools/v1/check?domain=coinbaseloggin.blogspot.com.mt Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,194 domains (57,639 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io