coinbaseelogin[.]blogspot[.]com[.]uy

The domain coinbaseelogin.blogspot.com.uy is currently listed as active with a high risk rating for brand impersonation targeting Coinbase. The report dated July 12, 2026 indicates the site presents the page title “Coinbase Login | Jump Start Your Crypto Portfolio,” suggesting an attempt to lure victims into credential submission. The threat type is identified as cryptocurrency‑related brand impersonation.

Technical investigation shows the hostname resolves to the IP address 142.250.186.129, which belongs to AS15169 operated by Google LLC and is located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE2 imprint, and HTTP requests receive a 302 redirect response. Detected web‑stack components include Blogger, Java, Python, OpenGSE, Google Analytics, Clipboard.js, and HTTP/3, indicating a typical hosted blog environment leveraged for malicious purposes.

Detection evidence confirms that the domain is blocked by PhishDestroy and appears on one public security blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports nine out of ninety‑five scanning engines flagging the domain as malicious. The combination of a low trust score, multiple vendor detections, and the explicit brand target reinforces the assessment of a high‑confidence threat.

Defenders are advised to enforce URL filtering policies that deny access to coinbaseelogin.blogspot.com.uy and to monitor traffic to the underlying IP 142.250.186.129 for any anomalous connections. Because the underlying content beyond the page title has not been independently verified, continuous observation is recommended to detect potential payload changes or additional command‑and‑control infrastructure. Immediate remediation should include updating endpoint and network blocklists to mitigate exposure.