coinbase-login[.]blogspot[.]com[.]es

The domain coinbase-login.blogspot.com.es is a confirmed phishing site engaged in brand impersonation targeting Coinbase, a cryptocurrency exchange. It presents a fraudulent login page titled 'Coinbase Login' to deceive users into entering credentials, posing an elevated risk of account compromise. No cryptocurrency drainer kit was detected. The site is currently taken offline, but it remains a documented threat for historical reference.

Technical analysis reveals that coinbase-login.blogspot.com.es was flagged by 13 of 95 security vendors on VirusTotal, including ADMINUSLabs, alphaMountain.ai, and BitDefender. It appears on one security blocklist (PhishDestroy) and resolves to the IP address 142.250.186.161, hosted on Google LLC's infrastructure in the US (AS15169). The SSL certificate is issued by Google Trust Services / WE2. Technologies detected include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3. Google Safe Browsing did not flag the domain, and registrar or creation date details are unavailable.

Users who interacted with coinbase-login.blogspot.com.es should immediately change their Coinbase passwords, enable two-factor authentication (2FA), and monitor accounts for unauthorized transactions. If cryptocurrency wallet access was exposed, revoke any token approvals and transfer funds to a new wallet. Report the phishing domain to Coinbase’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.