coiinbase-logiin[.]blogspot[.]hk

The domain coiinbase-logiin.blogspot.hk was created on February 21, 2026 and is currently active. It resolves to the IP address 142.251.141.129, which belongs to AS15169 Google LLC in the United States. The domain is hosted on Google’s infrastructure and uses a Google Trust Services certificate (WE2), indicating a valid TLS handshake but offering no protection against social engineering. Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 12 of 93 security vendors have flagged the domain.

The site appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The page title "How do I buy Bitcoin on Coinbase?" and the recorded brand target of Coinbase demonstrate a clear impersonation of the cryptocurrency exchange. Technical fingerprints show the use of Blogger, Java, Python, OpenGSE, and HTTP/3, while the Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The domain was registered through MarkMonitor, Inc., a registrar often leveraged for legitimate brand protection, suggesting the attacker may have compromised or spoofed a legitimate registration channel.

HTTP responses return a 302 redirect, a pattern commonly used to forward victims to credential‑harvesting pages. Defenders should add the domain to network and email blocklists, monitor DNS queries for the associated IP, and enforce multi‑factor authentication for any Coinbase‑related access. Continuous observation of traffic to the Google nameservers ns1.google.com, ns2.google.com, and ns3.google is advised to detect any further exploitation. No additional content analysis is available beyond the page title, leaving the exact phishing payload unverified, but the aggregated evidence warrants a high‑risk classification.