coinbaseloginu[.]blogspot[.]com

The domain coinbaseloginu.blogspot.com was created on July 31, 2000 and is hosted on Google infrastructure (IP 142.250.186.65, AS15169, Germany). The site resolves to a Blogger host and serves a page whose title is “coinbase”. The page title and the known brand target “Coinbase” indicate a wallet/seed phishing campaign aimed at extracting cryptocurrency credentials. Google Safe Browsing classifies the URL as social engineering, and 22 of 95 VirusTotal scanners have flagged it as malicious. Gridinsoft assigns a trust score of 0/100, while Scamadviser rates it 36/100, reflecting a high likelihood of fraud.

The SSL certificate is issued by Google Trust Services (WE2), consistent with the Google hosting environment. The domain uses Google public nameservers (ns1‑ns4.google.com). The registrar is MarkMonitor, Inc., a registrar commonly used by legitimate brands, suggesting possible abuse of a compromised or sub‑account registration. The site returned HTTP 404 at the time of analysis, and the current status is offline, but historical evidence shows it was previously active and was blocked by PhishDestroy and listed on at least one security blocklist. Detected technologies include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, indicating a fairly sophisticated hosting stack.

Uncertainty remains about the exact content of the page, the presence of credential‑capture forms, and whether the domain was ever pointed to a malicious payload before being taken down. Defenders should continue to block the domain at perimeter filters, add the IP address 142.250.186.65 to deny lists, and monitor for any future sub‑domains that resolve to the same Google‑owned IP range. Incident response teams should treat any credential or seed phrase submissions referencing “Coinbase” as compromised and advise affected users to rotate credentials and secure their wallets.