coinbase-login[.]blogspot[.]cz

This domain, coinbase-login.blogspot.cz, has been identified as a potential threat due to its impersonation of the Coinbase brand. The page title 'Coinbase Login' suggests that it attempts to deceive users into entering their credentials on a fraudulent site. While no specific drainer kit has been disclosed, the domain's intent to imitate Coinbase indicates a malicious attempt to harvest sensitive financial information.

Technical analysis reveals several indicators of compromise. VirusTotal reports that 13 out of 95 security vendors have flagged this domain, showcasing a substantial level of detection across various security platforms. The domain is registered through MarkMonitor, Inc., a common registrar for legitimate domains but also occasionally exploited by threat actors. It resolves to the IP address 142.250.185.129, located within Google's infrastructure (AS15169), and was created on February 06, 2007. Despite its age, its presence on at least one security blocklist and its detection by Google Safe Browsing (GSB) raise concerns about its persistent threat vector.

The domain is currently offline, as confirmed through multiple security sources. It has been blocked by PhishDestroy, reducing immediate risk to users. However, users should remain vigilant against similar domains that may arise, employing robust security measures such as multi-factor authentication and regular updates to security software. Continued monitoring of domain registries for similar impersonation attempts is advised to prevent future incidents.