coiinbase-logiin[.]blogspot[.]co[.]ke

Analysis of coiinbase-logiin.blogspot.co.ke indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 through Afriregister Limited and resolves to IP address 142.250.201.65, which belongs to AS15169 Google LLC in the United States. The site presents a page titled “How do I buy Bitcoin on Coinbase?” and is hosted on the Blogger platform, employing Java, Python, OpenGSE, and HTTP/3 technologies. TLS is provided by a Google Trust Services certificate (WE2), confirming the use of Google’s SSL infrastructure.

HTTP requests return a 302 redirect, a behavior commonly observed in phishing redirects. Security vendors have flagged the domain: seven of ninety‑three VirusTotal scanners reported detections, and the domain appears on three external blocklists. It has been actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing categorises the site as social engineering, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The nameservers listed are ns1.google.com through ns4.google.com, consistent with the Google hosting environment. While the page title and brand target confirm a Coinbase impersonation, the exact content of the landing page has not been publicly disclosed, leaving the specific lure (e.g., credential harvest, crypto‑drain) unverified. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for related C2 traffic to the Google‑hosted IP, and update detection signatures to include the observed redirect pattern and SSL fingerprint. Organizations should also educate users about unsolicited requests to “buy Bitcoin on Coinbase” from unofficial blogspot URLs, emphasizing verification of legitimate Coinbase domains.