coinbaseloginn[.]blogspot[.]be

The domain coinbaseloginn.blogspot.be is identified as a high‑risk brand‑impersonation campaign targeting Coinbase users. The site presents the page title "Coinbase Login" and is explicitly linked to the Coinbase brand, indicating an attempt to harvest credentials associated with the cryptocurrency platform. The campaign is active as of the report date, July 12, 2026, and carries a unique seed identifier 606b4b for internal tracking.

Infrastructure analysis shows the domain resolves to IP address 142.250.185.193, which belongs to Google LLC (ASN 15169) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE2 label, confirming the use of legitimate Google‑issued certificates. HTTP requests receive a 302 redirect response, and the service stack includes Blogger, Java, Python, OpenGSE, and HTTP/3, reflecting a typical Google Blogger hosting environment.

Detection metrics indicate that two out of ninety‑five security vendors on VirusTotal have flagged the domain, and Google Safe Browsing classifies it under the "SOCIAL_ENGINEERING" category. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. These signals collectively reinforce the high‑risk assessment and justify immediate defensive action.

While the page title and hosting details are confirmed, the actual content of the landing page has not been captured in this report, leaving the specific credential‑harvesting mechanisms uncertain. Defenders should prioritize blocking the domain at perimeter firewalls and DNS resolvers, monitor for related malicious traffic to the associated IP address, and incorporate the indicator into threat‑intel feeds. Continuous re‑evaluation is recommended to capture any evolution of the payload or additional infrastructure components.