login-coin[.]blogspot[.]com[.]au

Analysis of login-coin.blogspot.com.au shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The site was registered on February 21, 2026 and is hosted on Google’s infrastructure (ASN15169, IP 142.250.187.225, Germany). It resolves to a Google‑issued SSL certificate issued by Google Trust Services / WE2, indicating a legitimate TLS handshake but providing no assurance about the content. The HTTP response is a 302 redirect, a common technique to funnel victims to a credential‑harvesting endpoint. Page metadata contains the title "coinbase login - my coinbase account", directly referencing the Coinbase brand and aligning with the declared scam type of a crypto‑related social‑engineering attack. Detected technologies include Blogger, Java, Python, OpenGSE, Google AdSense, and HTTP/3, reflecting a typical blog‑hosted phishing setup.

The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing flags the site for social engineering, and VirusTotal reports that 11 of 95 scanning engines have identified it as malicious, reinforcing the suspicion. The registrar is listed as MarkMonitor, Inc., a service often used by legitimate brands, which may obscure attribution but does not mitigate the observed malicious behavior. Gridinsoft assigns a trust score of 0/100, indicating an extremely low reputation.

Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the four Google nameservers (ns1‑ns4.google.com), and treat any credential submissions to the URL as compromised. Users should be warned that any login prompt referencing Coinbase on this domain is fraudulent. Further investigation is needed to determine the exact payload delivered after the redirect, but the current evidence is sufficient to classify the site as an active, high‑risk Coinbase impersonation scam.