coinbase-pro-sign-ins[.]blogspot[.]com[.]ee

The domain coinbase-pro-sign-ins.blogspot.com.ee was registered on February 21, 2026 through the registrar Zone Media OÜ and currently resolves to the Google‑owned IP address 142.250.185.129 (AS15169, United States). DNS resolution is served by Google name servers ns1.google.com through ns4.google.com, and the site presents an SSL certificate issued by Google Trust Services under the WE2 label, indicating use of Google’s hosting infrastructure. HTTP requests receive a 302 redirect response and the page title returned is "Blog not found", suggesting the underlying Blogger platform is being leveraged without a visible landing page. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a typical Google Cloud deployment.

The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing flags the site for social engineering, and VirusTotal records 13 positive detections out of 95 scanned vendors, reinforcing the malicious classification. The threat is identified as a high‑risk brand impersonation campaign targeting Coinbase users, categorized as a crypto scam.

While the available evidence confirms the infrastructure and detection status, the exact content of the hosted page has not been captured; the "Blog not found" title provides no further insight into the phishing payload. Defenders should add the domain to inbound and outbound filtering rules, monitor DNS queries for the associated Google name servers, and enforce URL reputation checks that incorporate the listed blocklists and Safe Browsing signals. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or additional detections as the campaign remains active.