coinbase-login[.]blogspot[.]hu

The domain coinbase-login.blogspot.hu was observed on July 12, 2026 as an active brand‑impersonation site targeting Coinbase. The page title returned by the server is “Coinbase Login”, indicating a direct attempt to mislead users seeking credential entry. The site is hosted on the Blogger platform, which provides a free content management environment.

Network analysis shows the domain resolves to IP address 142.250.80.97, which belongs to AS15169 Google LLC and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE2 profile, confirming the use of Google’s certificate authority. HTTP responses return a 302 redirect, and the service negotiates HTTP/3, suggesting recent protocol support.

Static detection indicates that 13 of 95 security vendors on VirusTotal have flagged the domain as malicious, and the Gridinsoft trust score is 0 out of 100. The domain is listed on a single security blocklist and has been blocked by PhishDestroy. The risk rating assigned is high, reflecting the combination of brand impersonation, low trust score, and vendor detections.

While the presence of Java, Python, OpenGSE, and Clipboard.js libraries has been identified, the actual payload or credential‑harvesting mechanisms have not been publicly disclosed. Consequently, the precise methods used to capture user data remain uncertain. Defenders should enforce domain‑based blocking for coinbase-login.blogspot.hu, monitor DNS queries to the associated IP, and apply heuristic filters that detect redirects to Google‑hosted Blogger URLs with suspicious page titles.

Continued observation is recommended to capture any changes in the site’s content or infrastructure. Correlation with other Coinbase‑related phishing indicators may reveal shared command‑and‑control resources. Organizations should educate users about the legitimate Coinbase login URL and advise verification of TLS certificates before entering credentials.