coiinbase-logiin[.]blogspot[.]com[.]co

PhishDestroy has identified a sophisticated phishing domain, coiinbase-logiin.blogspot.com.co, designed to impersonate the legitimate cryptocurrency exchange Coinbase. The page title 'How do I buy Bitcoin on Coinbase?' lures victims into entering their login credentials, which are then harvested by attackers. This domain poses a high risk of account takeover and financial theft, as it mimics Coinbase's interface to trick users into revealing sensitive information.

Technical analysis reveals that this domain was registered on February 21, 2026, through MarkMonitor, Inc., and resolves to IP address 172.217.20.129. It is secured with an SSL certificate from Google Trust Services (WE2), adding a false sense of legitimacy. VirusTotal flags this domain with a 16/95 detection rate, indicating that 16 security vendors out of 95 identify it as malicious. Additionally, it appears on 3 security blocklists and is flagged by Google Safe Browsing for phishing. The domain's name, coiinbase-logiin, contains slight misspellings ('coiin' instead of 'coin', 'logiin' for 'login') that are easy to overlook.

Users who have visited this site should immediately change their Coinbase passwords and enable two-factor authentication if not already active. It is also advisable to monitor account activity for unauthorized transactions and contact Coinbase support if any suspicious activity is detected. To avoid such threats in the future, always verify URLs by typing them manually or using trusted bookmarks. PhishDestroy offers a free URL checker to help users confirm the legitimacy of any website before entering credentials.