coiinbase-logiin[.]blogspot[.]cz

Analysis of coiinbase-logiin.blogspot.cz, created on 21 February 2026, shows a high‑risk crypto‑scam infrastructure that directly impersonates Coinbase. The domain is hosted on Blogger and resolves to the Google‑owned IP address 216.58.206.33, which is geolocated to Germany and belongs to AS15169 (Google LLC). The site uses Google Trust Services / WE2 for its TLS certificate, indicating a legitimate‑looking HTTPS endpoint, and the HTTP response is a 302 redirect, a common technique for forwarding victims to malicious payloads. The page title "How do I buy Bitcoin on Coinbase?" further reinforces the brand‑impersonation intent.

Google Safe Browsing flags the site for social engineering, and 16 of 93 VirusTotal scanners have flagged the domain, confirming its malicious reputation. The domain’s trust score from Gridinsoft is 0 out of 100, and it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, demonstrating that multiple protective services have already identified it as abusive. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, suggesting a standard Blogger deployment possibly augmented with custom scripts.

The registrar listed as MarkMonitor, Inc. is commonly used for legitimate brand protection, indicating possible abuse of a compromised or mis‑configured account. Defenders should immediately block coiinbase-logiin.blogspot.cz at network perimeters and endpoint filters, add the domain to URL filtering policies, and monitor for related traffic to the associated Google IP range. Threat intelligence teams should update phishing and crypto‑scam signatures, and SOC analysts should watch for similar sub‑domains that combine misspelled brand names with the "blogspot.cz" TLD, as the pattern may be reused in future campaigns.