login-coin[.]blogspot[.]com[.]co

The domain login-coin.blogspot.com.co is assessed as having an elevated risk level due to its specific threat type of brand impersonation. This domain impersonates the well-known cryptocurrency platform Coinbase, potentially leading users to unwittingly provide sensitive information to malicious actors.

Infrastructure analysis reveals that login-coin.blogspot.com.co was registered through MarkMonitor, Inc., a registrar known for domain management services. The domain has been flagged by 9 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among the cybersecurity community. The domain resolves to the IP address 142.251.140.161, which is located in the United States and belongs to AS15169 Google LLC. It was created on February 21, 2026, and currently appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services / WE2, which may lend a false sense of security to unsuspecting users. The page title 'coinbase login - my coinbase account' further reinforces the domain's attempt to mimic the legitimate Coinbase login page.

To mitigate the risks associated with brand impersonation, users should verify the URL of the website they are visiting, ensuring it matches the official Coinbase domain. Security teams should monitor for any related domains or IP addresses and implement appropriate blocking mechanisms. Additionally, educating users about the signs of brand impersonation, such as subtle differences in domain names and unexpected prompts for sensitive information, is crucial in preventing successful attacks.