coinsbitlogin[.]blogspot[.]com

Analysis of coinsbitlogin.blogspot.com indicates active brand impersonation targeting Coinbase users. The domain, hosted on Blogger infrastructure, presents a page titled 'Coinsbit Login,' which does not match the legitimate Coinbase branding. While the domain itself was registered on July 31, 2000, through MarkMonitor, Inc., its current use aligns with phishing activity. The page resolves to IP address 142.250.184.225 and employs technologies including Java, Python, OpenGSE, Clipboard.js, and HTTP/3. Security vendors have flagged the domain, with 11 of 95 detecting it as malicious, and it appears on at least one security blocklist. Google Safe Browsing has classified the site under 'SOCIAL_ENGINEERING,' further supporting its identification as a phishing threat. The SSL certificate is issued by Google Trust Services, which is consistent with Blogger-hosted domains but does not mitigate the risk. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. The exact content of the page has not been analyzed, but the combination of brand impersonation, security flags, and hosting context strongly suggests malicious intent.