coinbase-pro-sign-ins[.]blogspot[.]com

This domain, coinbase-pro-sign-ins.blogspot.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. The domain mimics legitimate Coinbase login infrastructure, likely intended to harvest user credentials or facilitate unauthorized access to accounts. No direct evidence of a crypto drainer kit was observed, but the presence of a fake login page aligns with credential theft tactics commonly employed in phishing campaigns. Analysis indicates the domain was flagged by 12 out of 95 security vendors on VirusTotal, a notable detection rate for a recently observed threat. It was registered through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains. The domain resolves to the IP address 142.251.143.1, hosted under AS15169 (Google LLC), and was created on February 21, 2026. Google Safe Browsing categorizes the domain as phishing, and it appears on three security blocklists, including PhishDestroy and MetaMask. The SSL certificate is issued by Google Trust Services, which does not inherently validate the legitimacy of the site. As of the latest assessment, coinbase-pro-sign-ins.blogspot.com has been taken offline, reducing immediate exposure risks. However, the infrastructure may resurface under a different domain or hosting provider. Users who accessed the site prior to its removal should assume potential credential compromise and take immediate remedial actions, including password resets and account monitoring. Organizations should update blocklists to include this domain and monitor for related indicators of compromise. The risk level remains elevated due to the targeted nature of the impersonation and the potential for residual impact on affected users.