coinbase-login[.]blogspot[.]com[.]au

The domain coinbase-login.blogspot.com.au has been identified as a high-risk phishing site specializing in brand impersonation. Analysis indicates the domain specifically targets Coinbase users by presenting a fraudulent login interface designed to harvest credentials. As of the latest assessment, the domain is currently offline, though prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises but occasionally exploited for phishing campaigns. The domain resolves to the IP address 142.250.76.97, located within the United States under AS15169 (Google LLC). Detection metrics show the domain was flagged by 14 of 95 security vendors on VirusTotal, with additional listings on one security blocklist. Google Safe Browsing explicitly classified the domain as phishing, and the page title was recorded as 'Coinbase Login,' further confirming its intent to deceive. The SSL certificate was issued by Google Trust Services (WE2), which, while legitimate, does not mitigate the domain's fraudulent purpose. Given the domain's current offline status, immediate threat mitigation has been achieved. However, organizations and users are advised to remain vigilant for similar campaigns leveraging subdomains of legitimate platforms. Security teams should monitor for indicators of compromise, including the IP address 142.250.76.97 and the registrar MarkMonitor, Inc., in logs. Users who may have interacted with the domain should immediately reset their credentials and enable multi-factor authentication on all financial accounts. Proactive blocking of domains registered through high-risk patterns or impersonating trusted brands is recommended to prevent future incidents.