coinbase-pro-sign-ins[.]blogspot[.]cl

The domain coinbase-pro-sign-ins.blogspot.cl was registered on February 21, 2026 through MarkMonitor, Inc. and resolves to the IP address 142.251.208.1, which belongs to AS15169 Google LLC located in the United States. DNS resolution is provided by the Google nameserver set ns1.google.com through ns4.google.com, and the site presents a TLS certificate issued by Google Trust Services under the WE2 program, indicating a valid HTTPS endpoint. HTTP requests receive a 302 redirect response and the page title returned by the server is "Blog not found," suggesting that the underlying Blogger platform is being used as a placeholder rather than a fully populated site. Technology fingerprints identify Blogger, Java, Python, OpenGSE and HTTP/3, all consistent with a typical Google-hosted blog environment.

Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 14 of 93 security scanners have flagged the host, reinforcing the malicious classification. Independent blocklists, including PhishDestroy, MetaMask and SEAL, have listed the domain, and it appears on three additional security blocklists, confirming its active status across multiple threat‑intelligence feeds. The domain is explicitly associated with a brand‑impersonation campaign targeting Coinbase and is categorized as a crypto‑scam.

Analysis indicates that the adversary leverages a legitimate Google‑owned hosting service to gain inherent trust, while the redirect and lack of substantive content hide the malicious payload until a victim follows a crafted link. Because the site currently returns only a generic "Blog not found" page, the exact phishing content has not been captured, leaving the specific lure or credential‑harvesting mechanism uncertain.

Defenders should immediately block the domain at network perimeters and update URL filtering policies to include the listed blocklists.