coiinbase-logiin[.]blogspot[.]ru

Analysis indicates that coiinbase-logiin.blogspot.ru is an active brand-impersonation domain targeting Coinbase users. The domain was registered on August 29, 2005, through RU-CENTER-RU, though its infrastructure is hosted on Google Blogger (AS15169, Google LLC) with an IPv6 address of 2404:6800:4004:807::2001 located in Australia. The SSL certificate is issued by Google Trust Services (WE2), and the domain resolves to Google nameservers (ns1.google.com, ns2.google.com, ns3.google.com). The page title, 'How do I buy Bitcoin on Coinbase?', explicitly references Coinbase procedures, aligning with the classified scam type of 'Crypto Scam' and the brand target 'Coinbase' in available intelligence. Technologies detected include Blogger, Java, Python, and OpenGSE, with HTTP/3 support and a 302 redirect status. The domain appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100. As of July 12, 2026, 14 of 93 security vendors on VirusTotal flag the domain, confirming its malicious classification. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring its resolution paths. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, crypto-themed page title, and detection by multiple security vendors supports its classification as active phishing infrastructure.