learn-coinbase[.]blogspot[.]com

The domain learn-coinbase.blogspot.com is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though it previously hosted content mimicking Coinbase’s official educational resources under the page title 'Coinbase Learn.' This activity aligns with phishing tactics designed to harvest credentials or distribute malicious payloads by exploiting user trust in the targeted brand. Infrastructure analysis reveals the domain resolved to IP address 142.250.185.211, associated with AS15169 (Google LLC) in the United States. The domain was registered through MarkMonitor, Inc. on July 31, 2000, though recent malicious activity suggests compromise or repurposing. Detection metrics indicate 11 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classified it as phishing. The domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE2), does not mitigate the underlying threat. The combination of brand impersonation, phishing classification, and vendor detections underscores the high-risk nature of this infrastructure. As of the latest assessment, learn-coinbase.blogspot.com has been taken offline, likely due to enforcement actions. However, users who accessed the domain prior to its removal may remain at risk. Organizations and individuals are advised to block the domain and its associated IP (142.250.185.211) at the network level, revoke any credentials potentially exposed during interactions, and monitor for indicators of compromise. Security teams should review logs for connections to the domain or IP and correlate with other phishing campaigns targeting cryptocurrency platforms. Proactive measures, including user education on brand impersonation tactics, are recommended to prevent recurrence.