coinbaseloginn[.]blogspot[.]in

The domain coinbaseloginn.blogspot.in is observed hosting a brand‑impersonation site that targets users of the cryptocurrency exchange Coinbase. The page title returned by the HTTP response is “Coinbase Login”, directly referencing the targeted brand. A safe‑browsing service categorises the site under social‑engineering, and multiple security vendors have raised alerts, indicating a high‑risk profile. Infrastructure analysis shows the domain was registered on 24 June 2020 through a registrar associated with MarkMonitor, Inc. DNS resolution points to the IP address 172.253.122.132, which belongs to the AS15169 range operated by Google LLC and is located in the United States. The domain uses Google’s public nameservers (ns1‑ns4.google.com) and serves content over TLS with a certificate issued by a trusted authority, confirming the use of legitimate hosting infrastructure. The HTTP response code is 302, indicating a redirection that is typical of credential‑harvesting pages. The site is hosted on the Blogger platform and employs technologies such as Java, Python, OpenGSE, and HTTP/3, suggesting a potentially automated kit. Seven out of ninety‑five security scanners have flagged the domain, and it appears on at least one blocklist, reinforcing the observation that the site is actively used for malicious purposes. Defenders should add coinbaseloginn.blogspot.in to network and endpoint blocklists, monitor DNS queries for the domain and its associated Google nameservers, and consider sinkholing the IP address to disrupt traffic. User education campaigns should warn against unsolicited requests to log into Coinbase via non‑official URLs, and incident response teams should treat any credential submissions to this domain as compromised.