coinbaseelogin[.]blogspot[.]fi

This domain coinbaseelogin.blogspot.fi is currently active with a high risk classification for brand impersonation targeting Coinbase in a cryptocurrency scam. It resolves to the IPv6 address 2a00:1450:4001:80b::2001 in DE under AS15169 Google LLC. VirusTotal detection stands at 13 out of 95 security vendors, and the domain appears on exactly one security blocklist. The recorded page title is Coinbase Login | Jump Start Your Crypto Portfolio, and the HTTP status code returned is 302. The domain remains blocked by PhishDestroy.

Registration records show the domain was created on March 07, 2011 through MarkMonitor, Inc. Nameservers listed are ns1.google.com. The SSL certificate is issued by Google Trust Services under the WE2 profile. Gridinsoft assigns a trust score of 0/100. Technologies identified on the infrastructure include Blogger, Java, Python, OpenGSE, Google Analytics, Clipboard.js, and HTTP/3.

Analysis indicates the domain operates on infrastructure tied to Google services, consistent with the nameserver and certificate data. What remains uncertain is the precise final destination after the 302 redirect and any additional subdomains or payloads that may be served. No further behavioral telemetry beyond the listed blocklist hits and vendor flags is available in the current data set.

Defenders should add the domain to blocklists, monitor DNS queries and HTTP requests to coinbaseelogin.blogspot.fi, and correlate traffic against the known IPv6 address. Review of logs for connections to the same ASN or nameserver patterns is advised to identify related infrastructure. Continued observation of the active status and any changes in the VirusTotal score or blocklist presence is recommended.