coinbaseprologine[.]blogspot[.]kr

This domain, coinbaseprologine.blogspot.kr, is actively flagged as a high-risk crypto phishing site targeting Coinbase users. Infrastructure analysis reveals the domain was registered on April 13, 2007, through Whois Corp., though its current malicious use appears to be a recent repurposing of an older domain. The site resolves to IP 142.250.186.161, hosted on AS15169 (Google LLC) in the United States, and uses Google nameservers (ns1-4.google.com), indicating it is operating on Blogger infrastructure. The page title, 'Coinbase Login | Digital Asset Exchange - Buy & Trade Now,' directly mimics Coinbase's branding, and the scam type is explicitly classified as a crypto scam. Technical indicators include a 302 HTTP redirect status, suggesting the site may funnel victims to another malicious endpoint. Detected technologies include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, which are consistent with a dynamically generated phishing page. The SSL certificate is issued by Google Trust Services (WE2), providing a false sense of security. The domain appears on one security blocklist and is flagged by 14 of 95 security vendors in a recent scan, confirming its malicious classification. Defenders should note that this domain remains active as of July 12, 2026, and continues to pose a threat to users attempting to access Coinbase services. The use of Blogger infrastructure complicates takedown efforts, as it leverages legitimate hosting services. Organizations are advised to block the domain and IP at the network level, monitor for related subdomains or redirect chains, and alert users to the impersonation risk. No further details about the exact phishing mechanics or payload are available at this time, but the combination of brand impersonation, crypto scam classification, and security vendor detections provides sufficient evidence for immediate mitigation.