coinbase-wallet-login-to[.]blogspot[.]ch

The domain coinbase-wallet-login-to.blogspot.ch was registered through Google LLC on 21 February 2026. DNS resolution points to 142.250.201.65, an address owned by Google LLC (ASN 15169) located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE2 label, indicating a legitimate certificate chain but does not mitigate the malicious intent. HTTP requests receive a 302 redirect and the returned page title is “Blog not found”, which offers no legitimate content.

Automated fingerprinting identified the hosting platform as Blogger and detected runtime components including Java, Python, OpenGSE and support for HTTP/3, all consistent with the underlying infrastructure rather than a custom phishing front‑end. VirusTotal analysis shows that 13 of 95 scanned security vendors have marked the domain as malicious, and Google Safe Browsing classifies it under social engineering. The domain is currently listed on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its reputation as a high‑risk crypto‑related impersonation campaign. The threat actor is targeting the Coinbase brand, as indicated by the domain name and the “Crypto Scam” classification, although the actual page content has not been captured beyond the generic “Blog not found” title.

While the infrastructure details confirm the use of a legitimate hosting provider, the combination of brand‑impersonation naming, redirection behavior, and multiple vendor detections strongly suggests an active credential‑harvesting or fund‑diversion operation. Defenders should continue to block the domain at network perimeters, update endpoint and browser protection with the latest blocklist entries, and monitor for any related C2 infrastructure that may share the same IP address or certificate.