coinbase-login[.]blogspot[.]ru

Analysis indicates that the domain coinbase-login.blogspot.ru is actively impersonating Coinbase, presenting a high-risk threat to users attempting to log into their cryptocurrency accounts. The domain, registered through RU-CENTER-RU, was created on August 29, 2005, and currently resolves to the IP address 142.250.185.129, which is associated with Google LLC in the United States. Despite its long registration history, the domain has been flagged by 12 out of 95 security vendors on VirusTotal, suggesting that it has recently been identified as a potential phishing site. The Gridinsoft trust score of 0/100 further underscores the domain's lack of credibility and its potential malicious intent. The SSL certificate is issued by Google Trust Services, which may add a false sense of security to unsuspecting users. The page title 'Coinbase Login' is designed to mimic the legitimate login page of Coinbase, potentially leading users to enter their credentials into a fraudulent site. Infrastructure analysis reveals that the domain is hosted using Blogger, and technologies such as Java, Python, OpenGSE, and Clipboard.js are detected, which could be indicative of a sophisticated phishing operation. While the exact content of the site has not been analyzed, the high risk level and the use of a familiar brand name suggest that it is likely a phishing site aimed at stealing cryptocurrency-related credentials. Defenders should take immediate action to block this domain and educate users about the dangers of visiting unverified login pages. They should also monitor network traffic for any signs of interaction with this domain and implement multi-factor authentication to reduce the risk of account compromise. Additionally, organizations should consider deploying DNS filtering and web security solutions to prevent access to known malicious domains.