coinbasesupportsnumber[.]blogspot[.]com

PhishDestroy identifies coinbasesupportsnumber.blogspot.com as an active Coinbase brand impersonation domain hosting a crypto drainer kit designed to harvest user credentials and initiate unauthorized transfers. The site’s naming convention leverages Coinbase’s branding to deceive victims into entering sensitive login details or crypto wallet seeds, with infrastructure engineered to facilitate credential theft and fund misappropriation. No evidence of a custom drainer kit was observed in sandbox analysis; however, the fraudulent UI and SSL-backed hosting suggest a high-fidelity replica targeting Coinbase users. The domain operates under the guise of a “support” portal, exploiting trust in official brand channels to maximize phishing success rates.

Technical indicators reveal this domain resolves to IP 142.251.13.132, hosted behind Google’s Trust Services SSL certificate. Registered through Blogger (Google), the domain was created recently and remains unflagged across major blocklists at the time of analysis. VirusTotal shows 0 detections out of 95 scanners, indicating minimal detection coverage despite clear impersonation intent. WHOIS data shows a privacy-protected registrant, consistent with malicious redirection tactics. The absence of prior blocklist entries suggests this campaign may be newly deployed or operating below detection thresholds.

As of this report, coinbasesupportsnumber.blogspot.com remains active and under investigation. Security teams are advised to block the domain at DNS and network levels and flag all associated IPs. Users are urged to verify support contacts via official Coinbase channels only and enable multi-factor authentication. Risk remains elevated due to low detection rates and the use of trusted hosting infrastructure. Immediate action is required to prevent credential compromise and fund loss.