coinbasewikisupportnumber[.]blogspot[.]com

This domain is flagged as a high-risk brand impersonation scam designed to deceive users of a major cryptocurrency exchange platform. Analysis indicates the site mimics legitimate support channels, likely to harvest credentials, distribute malware, or facilitate unauthorized transactions. The specific threat type involves social engineering tactics to exploit trust in the targeted brand, with infrastructure designed to evade initial detection while maintaining a veneer of legitimacy. Infrastructure analysis reveals the domain was registered through Google Blogger on March 26, 2026, and resolves to the IP address 172.217.16.193, a known Google hosting range. The SSL certificate is issued by Google Trust Services, providing an appearance of security while the domain is actively blocked by three security blocklists, including MetaMask and PhishDestroy. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious, a significant indicator of confirmed fraudulent activity. The domain has since been taken offline, though historical records confirm its prior operational status. Mitigation steps for this threat type include immediate blacklisting of the domain across all security gateways and endpoint protection systems. Organizations should conduct retrospective log analysis to identify any prior interactions with the domain, particularly focusing on authentication attempts or outbound connections to the resolved IP address. User awareness training should emphasize the risks of third-party support channels, especially those hosted on consumer blogging platforms. Security teams are advised to monitor for similar impersonation patterns, such as domains combining brand names with support-related keywords, and implement proactive domain squatting detection for high-value targets.