coinbaseloginn[.]blogspot[.]it

Analysis of coinbaseloginn.blogspot.it shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to 142.250.185.161, an IP owned by Google LLC (ASN 15169) and is served over HTTPS with a Google Trust Services certificate. HTTP responses return a 302 redirect, and the page title is reported as "Coinbase Login," matching the declared brand target. VirusTotal records indicate that 12 of 95 scanned security vendors flag the domain as malicious, and it appears on one public blocklist, with PhishDestroy already blocking it. Scamadviser assigns a trust score of 10 / 100, reinforcing the low credibility of the site. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a typical blog‑hosted phishing kit. The infrastructure suggests the attacker leveraged legitimate Google hosting to gain trust, while the SSL certificate further masks malicious intent. No additional content analysis is available, so the precise look‑and‑feel of the landing page remains unverified. Defenders should add the domain to deny‑list filters, monitor DNS queries for the associated IP, and enforce brand‑specific protections for Coinbase login URLs. Continued observation is advised to detect any potential changes in hosting or content.