coin-virtue[.]blogspot[.]be

Analysis indicates that coin-virtue.blogspot.be was registered on 21 February 2026 through MarkMonitor, Inc. and resolves to 142.251.208.161, an IP owned by Google LLC (AS15169) in the United States. The domain is hosted on Google’s Blogger platform and presents a page titled “Coin Virtue Money Conversions…”. The presence of Java, Python, OpenGSE libraries and support for HTTP/3 suggests a relatively modern web stack, but the page returns an HTTP 302 status, implying a redirection that may lead to a credential‑harvesting endpoint. The TLS certificate is issued by Google Trust Services under the WE2 intermediate, confirming the use of a valid Google‑managed HTTPS certificate.

Reputation checks show that Google Safe Browsing has flagged the URL for social engineering, and three independent blocklists currently list the domain. VirusTotal reports that nine out of ninety‑three scanning engines have identified the site as malicious, reinforcing the suspicion of phishing activity. Additional blocklist entries from PhishDestroy, MetaMask and SEAL confirm active mitigation by security vendors. The evidence points to an active generic phishing campaign that likely targets users searching for cryptocurrency conversion services, leveraging the “Coin Virtue” naming to attract victims.

However, the exact payload, credential capture mechanism, and any post‑exploitation behavior have not been publicly disclosed, leaving the full attack chain uncertain. Defenders should prioritize immediate blocking of coin-virtue.blogspot.be at network and endpoint layers, enforce URL filtering based on the listed blocklists, and monitor DNS queries for the associated Google‑owned IP range. Continuous re‑scanning with updated VirusTotal and Safe Browsing checks is advised, as the domain may evolve its content or redirect to additional infrastructure.