coinbase-pro-sign-ins[.]blogspot[.]co[.]at

On July 12, 2026, the domain coinbase-pro-sign-ins.blogspot.co.at was identified as an active crypto scam impersonating Coinbase. The domain is registered through MarkMonitor, Inc. and was created on February 21, 2026. Infrastructure analysis reveals that the domain resolves to the IP address 142.251.208.1, which is located in the United States and is part of the AS15169 network operated by Google LLC. The nameservers for this domain are ns1.google.com, ns2.google.com, ns3.google.com, and ns4.google.com, indicating a robust and potentially trusted hosting environment. The domain is flagged by Google Safe Browsing for social engineering, and 17 out of 93 security vendors on VirusTotal have identified it as malicious. The SSL certificate is issued by Google Trust Services, further suggesting a credible appearance. The page title is 'Blog not found,' which may be an attempt to evade detection or a result of the domain being redirected. The domain is currently blocked by PhishDestroy, MetaMask, and SEAL. Despite the redirection and lack of visible content, the domain's high risk level and active status indicate it is being used for malicious purposes. Defenders are advised to monitor this domain and implement blocking measures to prevent user exposure. The exact content and mechanisms used by the scam are not yet fully analyzed, but the domain's association with a known crypto scam and its flags from multiple security sources provide strong evidence of its malicious intent.