coinbaseloginn[.]blogspot[.]mx

Analysis indicates that the domain coinbaseloginn.blogspot.mx is actively serving a cryptocurrency‑focused brand‑impersonation campaign targeting Coinbase users. The site is classified as high risk and remains active as of the report date. The page title returned by the server is “Blog niet gevonden”, indicating that the underlying Blogger host returns a not‑found placeholder rather than a legitimate login interface. Infrastructure analysis reveals that the domain is hosted on Google’s Blogger platform and resolves to IP 142.250.186.161, which belongs to AS15169 Google LLC located in the United States. The TLS certificate is issued by Google Trust Services under the WE2 profile, and the service supports HTTP/3. Network traffic receives an HTTP 302 redirect, and the site runs Java, Python, and the OpenGSE framework, consistent with automated phishing kit deployments. Detection telemetry shows the domain is listed on two independent blocklists – PhishDestroy and PhishingDB – and Google Safe Browsing has flagged it for social engineering. VirusTotal scans report ten out of ninety‑five security vendors marking the domain as malicious. The Scamadviser trust score is 1 out of 100, reinforcing the low credibility of the site. Current intelligence does not include a detailed content dump, so the exact phishing payload or credential‑harvesting mechanisms remain unverified. Defenders should treat any traffic to this domain as hostile, enforce network‑level blocks, and monitor for related C&C patterns that may share the same IP or certificate. Ongoing observation of the hosting account and rapid updating of blocklists are advised to mitigate potential user exposure.