coinbase-pro-sign-ins[.]blogspot[.]sk

Analysis indicates that the domain coinbase-pro-sign-ins.blogspot.sk is actively being used for brand impersonation targeting Coinbase users. The site returns an HTTP 302 redirect and the observed page title is "Blog not found," suggesting that the underlying content is not publicly accessible. The domain was created on 2026-02-21 and resolves to IP 142.250.185.97, which is owned by Google LLC (AS15169) in the United States. TLS is provided by Google Trust Services under the WE2 certificate, confirming that a legitimate SSL certificate is in place. Detected platform components include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a Google‑hosted blog environment. The domain is listed on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal records indicate that 14 of 93 scanning engines have flagged the domain, and Google Safe Browsing classifies it as a SOCIAL_ENGINEERING threat. The intelligence categorizes the activity as a crypto scam that impersonates Coinbase, but no direct content analysis of the landing page or credential‑capture mechanisms is currently available. Defenders should block the domain at network perimeters, add it to DNS and URL filtering lists, and monitor for related indicators such as the Google nameservers (ns1‑ns4.google.com). User education campaigns should warn against unsolicited Coinbase login prompts and advise immediate credential changes if any account details may have been entered. Incident response teams should treat any reported interactions with the domain as compromised and initiate standard account recovery and forensic procedures.