coiinbase-logiin[.]blogspot[.]kr

Analysis indicates that the domain coiinbase-logiin.blogspot.kr is actively impersonating Coinbase, a cryptocurrency exchange platform, as part of a high-risk crypto scam campaign. The domain was registered through Whois Corp. and leverages Blogger infrastructure, resolving to the IP address 142.251.111.132, which is associated with AS15169 (Google LLC) in the United States. Nameservers are hosted under Google’s DNS infrastructure (ns1.google.com through ns4.google.com), a common tactic to lend credibility to phishing domains by utilizing reputable service providers. The page title, 'How do I buy Bitcoin on Coinbase?', explicitly targets users seeking Coinbase services, reinforcing the brand impersonation. Detection data from security vendors reveals that 15 of 93 engines flagged the domain as malicious, while it appears on at least one security blocklist. The domain’s creation date of April 13, 2007, predates the modern cryptocurrency era, suggesting it may have been repurposed from an older, dormant registration rather than newly registered for malicious activity. The HTTP 302 redirect status further indicates dynamic behavior, potentially used to evade detection or route victims through intermediate pages. Defenders should treat this domain as an active threat. The combination of brand impersonation, cryptocurrency-themed content, and partial vendor detection warrants immediate blocking at the network and endpoint levels. Given the use of Google-hosted infrastructure, monitoring for similar patterns—such as Blogger domains with slight misspellings of financial services brands—may help identify related campaigns. The exact content and functionality of the site remain unanalyzed, but the available indicators align with known crypto scam tactics.