coinbaseloginn[.]blogspot[.]com[.]br

coinbaseloginn.blogspot.com.br is flagged as a high‑risk brand‑impersonation site targeting Coinbase users. The domain resolves to 142.250.186.65, an IP address owned by Google LLC (AS15169) and located in Germany, and presents a valid Google Trust Services certificate (WE2). Infrastructure analysis shows the site is hosted on Blogger, using Google’s name‑servers (ns1‑4.google.com) and serving content over HTTP/3. The page title returned by the server is “Coinbase Login”, indicating a deliberate attempt to mimic the official Coinbase authentication portal. VirusTotal reports eight of ninety‑five scanners flagging the domain, and the site is listed on a security blocklist and blocked by PhishDestroy, confirming active malicious use. The domain was created on 05 Dec 2004 and is registered through Google LLC, but its recent activity aligns with a crypto‑scam campaign. No direct observation of the landing page is available, so the exact credential‑capture mechanism remains unknown. Defenders should immediately block the domain at perimeter and endpoint security layers, monitor DNS queries for the associated IP and name‑servers, and issue user advisories warning against any unsolicited requests to “Coinbase Login” pages hosted on Blogger subdomains. Ongoing telemetry should be collected to detect any future re‑use of the same infrastructure for similar impersonation attempts.