coinbase-wallet-extension[.]blogspot[.]com

PhishDestroy assesses coinbase-wallet-extension.blogspot.com as a high-risk domain, confirmed to be a brand impersonation attempt specifically targeting Coinbase users through fake wallet login pages. This threat falls under the category of crypto drainer attacks, where victims are tricked into entering credentials that are subsequently stolen.

The domain was registered through Google (ASN 15169) and resolves to IP 142.251.40.193, which is associated with Google's infrastructure. VirusTotal analysis shows 14 out of 95 security vendors flagged this site as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE2), and Google Safe Browsing has flagged the domain for phishing. The page title, "Coinbase Wallet Login: Chrome Extension Guide," is designed to deceive users into thinking it is an official resource. The domain is currently offline, but users should remain vigilant.

To protect against such threats, Coinbase users should always verify URLs by checking for official domains like coinbase.com. Avoid entering credentials on third-party sites, enable two-factor authentication, and use a hardware wallet for added security. Report any suspicious domains to Coinbase's security team and security vendors to help block future attacks.