coinbaseloginn[.]blogspot[.]am

Analysis indicates that the domain coinbaseloginn.blogspot.am is currently active and presents itself as a Coinbase login page. The site resolves to the IP address 216.58.206.65, which is owned by Google LLC and is associated with ASN 15169. Geolocation data places the server in Germany, and the SSL certificate is issued by Google Trust Services under the WE2 designation, confirming the use of a legitimate Google‑provided TLS chain.

Infrastructure profiling shows the site is built on the Blogger platform and incorporates Java, Python, OpenGSE, and HTTP/3 components. The HTTP response code observed during a request is 302, indicating a redirection that may be used to forward victims to a credential‑harvesting endpoint after initial page load. The domain registration appears to have been performed through Google’s registration service, aligning with the hosting provider identified in the ASN data.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting Coinbase users, specifically in the cryptocurrency sector. The page title returned is "Coinbase Login," matching the advertised intent. VirusTotal analysis reports that 4 out of 95 security vendors have flagged the domain, and it is listed on at least one public blocklist. PhishDestroy has also recorded the site as blocked, reinforcing the assessment of malicious intent.

While the available data confirms the domain’s alignment with credential‑stealing activity, the exact payload or backend collection mechanism has not been publicly disclosed, leaving the full scope of the operation uncertain. Defenders should prioritize network‑level blocking of the resolved IP address and the domain itself, enforce DNS sinkholing where feasible, and monitor for suspicious authentication attempts against Coinbase accounts originating from the identified IP range. Continuous re‑evaluation is recommended as additional indicators may emerge from future scans or threat‑share feeds.