coinbase-wallet-login-to[.]blogspot[.]mx

The domain coinbase-wallet-login-to.blogspot.mx was registered on February 21, 2026 through MarkMonitor, Inc. and is hosted on Google’s infrastructure, using the four Google public nameservers (ns1‑ns4.google.com). DNS resolution points to IP address 142.250.201.65, which belongs to AS15169 Google LLC located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE2 profile, confirming that the connection is encrypted but that the certificate is tied to Google’s own CA rather than the impersonated brand. An HTTP 302 response is observed, redirecting visitors without delivering substantive content; the page title returned by the server is “Blog not found,” indicating that the underlying Blogger platform does not host a legitimate landing page.

Security telemetry shows that 14 of 93 VirusTotal scanners flag the domain as malicious, and the URL appears on three independent blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among anti‑phishing services that the site is used for credential harvesting. Google Safe Browsing classifies the domain as a social‑engineering threat, and the threat type is recorded as a crypto‑related brand impersonation targeting Coinbase. The site’s technology stack includes Blogger, Java, Python, OpenGSE, and HTTP/3, which are typical of compromised or malicious Blogger deployments.

Given the high‑risk rating and the active status, defenders should add the domain to network‑level deny lists, enforce DNS filtering, and monitor outbound connections to the associated IP range. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset Coinbase credentials immediately. Continuous monitoring of the Google‑hosted IP space for similar patterns is recommended, as the infrastructure can be leveraged for rapid re‑deployment of phishing sites.