login-coinbase-pro[.]blogspot[.]in

Analysis of login-coinbase-pro.blogspot.in shows a high‑risk, active brand‑impersonation campaign targeting Coinbase. The domain was registered on June 24, 2020 through MarkMonitor, Inc. and resolves to the Google‑owned IP 142.251.140.161 (AS15169, United States). Infrastructure uses Google’s authoritative name servers (ns1‑ns4.google.com) and presents a Google Trust Services / WE2 TLS certificate. HTTP requests receive a 302 redirect and the page title returned is "Nie znaleziono bloga" (Polish for "Blog not found"). Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3. VirusTotal reports nine of ninety‑five scanners flagging the domain, and it appears on one external blocklist, currently blocked by PhishDestroy. The site is classified as a crypto‑scam type, impersonating Coinbase. No additional content analysis is available, so the exact phishing flow and payload remain uncertain. Defenders should add the domain to network and email blocklists, monitor DNS queries for the associated IP, and educate users that any unsolicited Coinbase login requests from this URL are fraudulent. Continuous threat‑intel feeds should be consulted for any further indicators as the campaign evolves.