coinbaseloginu[.]blogspot[.]ch

This domain is flagged as a high-risk brand impersonation targeting Coinbase. Analysis indicates it was registered on February 21, 2026, through Google LLC and resolves to IP 172.217.16.193, hosted on Google infrastructure (AS15169, US). The page title is 'coinbase', consistent with the impersonated brand. VirusTotal data shows 16 of 93 security vendors flagging this domain as malicious. It is blocked by multiple security solutions including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. Google Safe Browsing flags it for social engineering. The domain uses HTTP/3, JavaScript, Python, and Clipboard.js technologies, and employs a 302 redirect, likely to evade detection or redirect victims. The SSL certificate is issued by Google Trust Services (WE2). The Gridinsoft trust score is 0 out of 100, indicating no trustworthiness. The scam type is identified as a crypto scam, though exact page content has not been analyzed. Defenders should block this domain at DNS and email gateways, monitor for related subdomains or IPs, and warn users of the ongoing impersonation threat. The domain remains active as of July 12, 2026, and poses a direct risk to Coinbase users.