coinbasephonedesk[.]blogspot[.]com

This domain, coinbasephonedesk.blogspot.com, poses a high-risk brand impersonation threat targeting users of the Coinbase cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Coinbase support channels, likely to deceive users into disclosing account credentials, private keys, or other sensitive authentication details. The infrastructure suggests a phishing operation intended to exploit trust in the Coinbase brand, potentially leading to unauthorized account access or financial theft through social engineering tactics. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in malicious classification. The domain was registered through the Google Blogger platform on March 26, 2026, and currently resolves to the IP address 142.251.36.97, associated with Google infrastructure. It appears on three distinct security blocklists, further corroborating its malicious nature. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly leveraged by threat actors to lend credibility to fraudulent sites. Users who visited coinbasephonedesk.blogspot.com should immediately revoke any active sessions associated with Coinbase or related cryptocurrency services. If credentials or private keys were entered, affected accounts must be secured by changing passwords, enabling multi-factor authentication, and transferring assets to new, secure wallets. Monitor account activity for unauthorized transactions and report any suspicious behavior to the legitimate platform’s security team. Given the domain’s current offline status, further interaction is unlikely, but users should remain vigilant for similar impersonation attempts via other domains or communication channels.