coiinbase-logiin[.]blogspot[.]ch

Analysis indicates that the domain coiinbase-logiin.blogspot.ch is actively impersonating the cryptocurrency exchange Coinbase as part of a high-risk crypto scam campaign. The domain, hosted on Blogger infrastructure, resolves to IP address 142.250.185.161 under AS15169 (Google LLC) in the United States. The page title, 'How do I buy Bitcoin on Coinbase?', explicitly targets users seeking Coinbase services, reinforcing the brand impersonation classification. Infrastructure analysis reveals the use of Google Trust Services SSL certificate (WE2) and technologies including Java, Python, OpenGSE, and HTTP/3. The domain currently returns an HTTP 302 redirect status, suggesting dynamic behavior typical of phishing operations. Detection data from security vendors confirms malicious activity, with 12 of 93 engines on VirusTotal flagging the domain. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, while Gridinsoft assigns a trust score of 0/100. The exact content and functionality of the page remain unconfirmed, as no direct analysis of the site’s visual or interactive elements has been conducted. However, the combination of brand impersonation, crypto scam classification, and detection by multiple security mechanisms indicates a deliberate attempt to deceive users. Defenders should treat this domain as active and high-risk, prioritizing blocking at the network and endpoint levels. Further monitoring of associated IP ranges and registrar activity is recommended to identify related infrastructure.