coinbaseelogin[.]blogspot[.]com[.]co

This domain is flagged as a high-risk brand impersonation targeting Coinbase customers. The domain coinbaseelogin.blogspot.com.co was registered on July 8, 2012, through MarkMonitor, Inc., and remains active as of July 12, 2026. The page title, 'Coinbase Login | Jump Start Your Crypto Portfolio', directly references the Coinbase brand, and the threat type is confirmed as brand impersonation. Infrastructure analysis reveals the domain uses Blogger, Java, Python, OpenGSE, Google Analytics, Clipboard.js, and HTTP/3. It resolves to IP address 172.217.18.1, which is associated with Google infrastructure via an SSL certificate from Google Trust Services. The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal data shows 8 out of 95 security vendors flag this domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100, indicating strong consensus among security tools that this domain is deceptive. The registration date in 2012 is not inherently suspicious; it may indicate a compromised or repurposed legitimate blog hosting account now used for phishing. Analysis confirms the domain is actively serving content designed to impersonate Coinbase, likely to harvest login credentials or seed phishing attacks against cryptocurrency users. Defenders should add this domain to blocklists immediately, monitor for related domains or subdomains, and alert users that legitimate Coinbase services do not operate from blogspot.com.co subdomains. Organizations using Google Workspace or Blogger should investigate any internal accounts tied to this domain’s history to assess potential compromise. Users who have visited the page should change Coinbase passwords and enable two-factor authentication. The exact behavior of the page—such as whether it collects credentials, redirects to a fake portal, or deploys malware—has not been confirmed without direct content analysis, so the primary recommendation remains blocking and user education.