logincoinbasewallet[.]blogspot[.]com[.]uy

This domain, logincoinbasewallet.blogspot.com.uy, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was created to mimic legitimate Coinbase wallet login pages, likely to harvest user credentials and private keys. The page title explicitly displays 'Coinbase,' reinforcing the deception, while the infrastructure leverages a subdomain under blogspot.com.uy to evade detection and exploit trust in legitimate hosting services. Infrastructure analysis reveals the domain was registered on May 12, 2026, an anomalous future date suggesting potential registrar manipulation or inaccuracies in WHOIS records. It resolves to the IP address 142.251.20.132, hosted by Google LLC in the United States, and uses an SSL certificate issued by Google Trust Services (WE2). The domain is flagged by 15 out of 95 security vendors on VirusTotal, with detections including phishing and fraudulent activity. Additionally, it appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. As of the latest assessment, logincoinbasewallet.blogspot.com.uy has been taken offline, reducing immediate exposure risk. However, the underlying infrastructure remains a concern, as similar domains or subdomains may resurface under different names or hosting providers. Users who accessed the domain prior to its takedown should assume credential compromise and take immediate action, including revoking active sessions, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and related indicators of compromise to prevent future access attempts.