login-coin[.]blogspot[.]com[.]by

Analysis on login-coin.blogspot.com.by shows that the domain was created on 21 February 2026 and is currently active. The site presents the page title “coinbase login - my coinbase account,” directly referencing the Coinbase brand, and is classified as a crypto‑scam. The SSL certificate is issued by Google Trust Services under the WE2 certificate authority, confirming that the connection terminates at a Google‑controlled endpoint. DNS resolution points to IP 172.217.20.129, which belongs to AS15169 Google LLC, located in the United States. HTTP requests receive a 302 redirect response, a technique commonly used to forward victims to malicious payloads after initial page load.

Infrastructure fingerprints indicate the use of Blogger as the hosting platform, with ancillary technologies including Java, Python, OpenGSE, Google AdSense, and HTTP/3 support. Registration was performed through Reliable Software, Ltd, a registrar that has been observed in prior malicious campaigns. The domain appears on three independent security blocklists: PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis reports that 13 of 95 scanned security vendors flag the domain as malicious, reinforcing the suspicion of abusive activity.

Defenders should treat the domain as hostile. Immediate mitigation steps include adding login-coin.blogspot.com.by and its resolved IP address 172.217.20.129 to network‑level deny lists, configuring web‑gateway filters to block HTTP 302 redirects to this host, and ensuring endpoint protection solutions reference the three blocklists that already list the domain. Users of Coinbase should be warned that any login prompt originating from this URL is not authorized by the legitimate service, and credential‑oriented phishing attempts may be delivered after the redirect.