coiinbase-logiin[.]blogspot[.]rs

The domain coiinbase-logiin.blogspot.rs was registered on February 21, 2026 through Webglobe d.o.o. and is hosted on Google infrastructure (IP 142.251.208.161, AS15169 Google LLC, United States). DNS resolution uses Google’s public name servers (ns1.google.com, ns2.google.com, ns3.google.com). The site serves HTTP 302 redirects and presents a page titled “How do I buy Bitcoin on Coinbase?” indicating a crypto‑related lure.

Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, all consistent with a typical blog‑hosted malicious page. The SSL certificate is issued by Google Trust Services under the WE2 designation, confirming a valid TLS chain but offering no protection against the underlying content. Security‑vendor analysis on VirusTotal shows 11 of 93 scanners flag the domain as malicious, and the site is listed on three external blocklists. Additional defenses have already blocked it: PhishDestroy, MetaMask, and SEAL include it in their deny lists, and Google Safe Browsing flags it for social engineering.

The Gridinsoft trust score of 0 / 100 further underscores its low reputation. The page’s content has not been directly examined, so the exact phishing mechanics (e.g., credential capture forms) remain unknown, but the combination of brand impersonation, a crypto‑scam narrative, and the observed indicators confirm a high‑risk threat. Defenders should block the domain at network perimeter and DNS layers, update endpoint and web‑filter signatures to include the listed hash of the URL, and monitor for similar Blogger‑based impersonation campaigns targeting Coinbase or other financial services. Incident response teams should also correlate any user‑reported attempts to access this URL with authentication logs to detect compromised credentials, and consider issuing user awareness alerts referencing the specific page title and impersonated brand.