coinbase-login[.]blogspot[.]co[.]il

On July 24, 2026 the domain coinbase-login.blogspot.co.il was observed serving a page titled “Coinbase Login”. The site is hosted on Google infrastructure (IP 142.250.186.97, AS15169 Google LLC, located in Germany) and uses Google’s name servers ns1‑ns4.google.com. The SSL certificate is issued by Google Trust Services under the WE2 intermediate, confirming TLS termination on Google’s edge. HTTP responses return a 302 redirect, and the site advertises HTTP/3 support. Content analysis identified the Blogger platform together with Java, Python, OpenGSE and Clipboard.js, suggesting a multi‑language backend possibly used for credential harvesting.

The domain is registered through Domain The Net Technologies Ltd, and Gridinsoft assigns a trust score of 0/100, indicating a high likelihood of malicious intent. VirusTotal reports that 14 of 95 scanning engines flag the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on one external blocklist and has been blocked by PhishDestroy. The campaign is labeled a “Crypto Scam” and explicitly impersonates the Coinbase brand. Current status is active.

Uncertainty remains regarding the exact payload delivered after the redirect and whether additional infrastructure such as command‑and‑control servers is associated with the same IP range. Defenders should block the domain at perimeter and DNS layers, add the IP address 142.250.186.97 to deny lists, and ensure endpoint protection solutions are updated to include the 14 VirusTotal detections. Monitoring of Google’s name‑server queries for this host can provide early warning of new sub‑domains. Continuous review of Google Safe Browsing and other reputation feeds is recommended to capture any future changes in classification.