coiinbase-logiin[.]blogspot[.]com[.]ar

Analysis indicates that the domain coiinbase-logiin.blogspot.com.ar was registered on 21 February 2026 and is currently active. The site presents the page title “How do I buy Bitcoin on Coinbase?” which directly references the Coinbase brand, confirming a brand‑impersonation intent. The site is hosted on Google infrastructure, evidenced by the SSL certificate issued by Google Trust Services (WE2) and the IPv6 address 2404:6800:4004:81a::2001, which resolves to an AS15169 Google LLC location in Australia. The HTTP response is a 302 redirect, and the technology stack includes Blogger, Java, Python, OpenGSE, and HTTP/3. Nameserver configuration lists five authoritative servers (A.LACTLD.ORG, C.DNS.AR, D.DNS.AR, E.DNS.AR, F.DNS.AR). The domain appears on a single security blocklist (PhishDestroy) and receives a Gridinsoft trust score of 0/100. VirusTotal reports that 14 of 95 security vendors flag the domain, and Google Safe Browsing categorises it under SOCIAL_ENGINEERING. Registration data shows the registrar “nicar” repeated three times. No additional content analysis is available, so the exact phishing page layout cannot be confirmed. Defenders should block the domain at network and endpoint layers, monitor DNS queries for the listed nameservers, and consider adding the IP address to threat feeds. Ongoing observation is advised to detect any changes in hosting or page content.