coin-base-eng[.]blogspot[.]com

Analysis of coin-base-eng.blogspot.com indicates a high‑confidence brand‑impersonation threat targeting Coinbase users. The domain is hosted on Google infrastructure, resolving to IP 142.251.163.132, which belongs to AS15169 Google LLC in the United States. An SSL certificate issued by Google Trust Services (WE2) is present, matching the Google‑controlled nameservers ns1‑ns4.google.com. The site is identified as a Blogger blog, with technology fingerprints for Java, Python, OpenGSE, and HTTP/3, consistent with a Google‑hosted blogging platform.

The HTTP response is a 404 status, and the page title returned is "Blog not found," confirming that no content is currently served. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports a single detection out of 95 scanning vendors, demonstrating that at least one security product observed malicious characteristics. The domain appears on one external security blocklist and has been actively blocked by PhishDestroy. Registration was performed through MarkMonitor, Inc., a registrar commonly used for brand‑protection services, while the domain creation date of July 31 2000 suggests the site may have been dormant before being repurposed for a crypto‑related scam.

The precise malicious payload or phishing page has not been captured, leaving the exact content of the impersonation uncertain. Defenders should treat the domain as malicious: block DNS resolution and HTTP traffic to the host, add the domain to internal blocklists, and continue monitoring for any resurgence of content. Reporting the indicator to Google Safe Browsing and other threat‑sharing platforms is recommended to improve collective detection.