coinbaseelogin[.]blogspot[.]de

The domain coinbaseelogin.blogspot.de has been identified as a brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates this resource was designed to mimic the official Coinbase login interface, categorizing it as a credential harvesting attempt. The domain is currently offline, though prior activity suggests it was actively used in phishing operations. Infrastructure analysis reveals the domain was hosted on Google LLC infrastructure (AS15169) and resolved to the IP address 216.58.206.33, located in Germany. The SSL certificate was issued by Google Trust Services (WE2), a common characteristic of legitimate Google-hosted properties, which may have contributed to initial evasion of detection. Security vendor assessments flagged the domain as malicious, with 10 of 95 engines on VirusTotal identifying it as a threat. The domain appears on one security blocklist, and the page title, 'Coinbase Login | Jump Start Your Crypto Portfolio,' closely mirrors official Coinbase branding to deceive users. As of the latest verification, coinbaseelogin.blogspot.de has been taken offline, reducing immediate exposure risk. However, users who accessed the domain prior to its deactivation may remain vulnerable to credential compromise or follow-up attacks. Organizations are advised to monitor for unauthorized access attempts linked to this domain and implement multi-factor authentication for all cryptocurrency-related accounts. Security teams should update blocklists to include this domain and conduct retrospective log analysis to identify potential interactions with the resource. Users should verify domain authenticity before entering credentials, particularly for financial or cryptocurrency services.