coinbase-logina[.]blogspot[.]am

This domain, coinbase-logina.blogspot.am, is actively impersonating Coinbase as part of a high-risk crypto scam operation. Analysis indicates the domain is hosted on Google LLC infrastructure (AS15169) and resolves to IP 142.251.111.132, located in the United States. The page title, 'How to log in to Coinbase on another device?', explicitly targets Coinbase users, aligning with the reported scam type of crypto fraud. The domain is flagged by at least one security blocklist and has a Gridinsoft trust score of 0/100, confirming its malicious classification. Seven of 95 security vendors on VirusTotal have detected this domain as malicious, though the absence of additional vendor flags does not diminish its confirmed risk level.

Infrastructure analysis reveals the domain is registered through Google (Blogger platform) and employs technologies including Java, Python, OpenGSE, Clipboard.js, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE2), which is consistent with legitimate Blogger-hosted domains but does not mitigate the fraudulent intent. The HTTP status of 302 suggests potential redirection behavior, though the final destination remains unconfirmed. The domain remains active as of July 23, 2026, with no evidence of takedown or remediation.

Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where Coinbase or cryptocurrency-related services are used. Given its hosting on a reputable provider, additional scrutiny of Blogger-hosted subdomains with similar naming patterns is recommended. No evidence links this domain to a specific phishing kit or broader campaign, but its alignment with known crypto scam tactics warrants immediate action. The exact content and functionality of the site have not been analyzed, but the page title and scam classification indicate it is designed to harvest credentials or mislead users into transferring cryptocurrency.