login-coinbase-pro[.]blogspot[.]is

The domain login-coinbase-pro.blogspot.is is currently active and is being used to impersonate the Coinbase brand in a crypto‑scam campaign. DNS resolution points to 216.58.206.33, an address owned by Google LLC (AS15169) located in Germany. The site presents an HTTP 302 redirect and serves a page titled “Bloggið fannst ekki”. TLS is provided by Google Trust Services under the WE2 certificate, indicating the connection is terminated on Google’s infrastructure. Automated analysis identified the use of Blogger as the hosting platform together with server‑side components written in Java and Python, as well as the OpenGSE framework and HTTP/3 support. VirusTotal records show that 11 of 95 scanned security vendors have flagged the domain, and it is listed on a single public blocklist. The domain has also been added to the PhishDestroy blocklist. The available intelligence confirms the brand‑impersonation intent and the high‑risk classification, but no detailed payload or credential‑harvesting page has been captured, leaving the exact phishing workflow uncertain. Defenders should block the domain at network borders, add it to URL filtering and email security policies, and monitor for any related indicators such as the IP address 216.58.206.33 or the observed TLS certificate. Continuous re‑inspection of the site’s content is advised to detect any evolution of the malicious page.