logincoinbasewallet[.]blogspot[.]com[.]by

PhishDestroy identifies logincoinbasewallet.blogspot.com.by as an active brand impersonation domain targeting Coinbase users for credential theft. This fraudulent site mimics Coinbase’s login interface to harvest credentials and potentially enable crypto drainer attacks.

This domain was flagged by 7 out of 95 VirusTotal security vendors, registered through Reliable Software, Ltd on October 22, 2014. Google Safe Browsing further identifies it as a social engineering threat, classifying it under their SOCIAL_ENGINEERING category. The domain resolves to IP address 142.251.20.132, which is associated with Google’s infrastructure but is being abused for fraudulent purposes.

Users who visited this domain should avoid entering any credentials or sensitive information. Clear browser cache and cookies associated with Coinbase and run a malware scan. If credentials were entered, change passwords immediately and enable two-factor authentication. Report the domain to Coinbase’s fraud team and consider revoking any connected crypto wallet permissions.