coinbaseelogin[.]blogspot[.]is

coinbaseelogin.blogspot.is is flagged as a high‑risk brand‑impersonation site targeting Coinbase users. The site presents the page title “Coinbase Login | Jump Start Your Crypto Portfolio” and serves over HTTPS using a Google Trust Services / WE2 certificate, indicating it is hosted on Google’s infrastructure. DNS resolution points to 142.250.186.65, an IP owned by Google LLC in Germany (AS15169). HTTP responses return a 302 redirect, a common technique for steering victims to a credential‑harvesting endpoint. Analysis of the page’s technology stack reveals Blogger, Java, Python, OpenGSE, Google Analytics, Clipboard.js and support for HTTP/3, confirming the use of a generic web‑hosting kit rather than a dedicated phishing framework. VirusTotal records show 8 of 95 security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The domain is listed on one public blocklist and has been blocked by PhishDestroy, yet it remains active as of the report date. Defenders should add the fully qualified domain name and its resolving IP to outbound and inbound filtering rules, monitor for any related C2 traffic, and consider updating URL‑filtering policies to include the observed redirect pattern. Continuous re‑scanning is advised to capture any changes in payload or hosting configuration.