coiensquaarelogin[.]webflow[.]io

PhishDestroy identifies an active credential-phishing campaign targeting cryptocurrency users via the domain coiensquaarelogin.webflow.io, a homograph impersonation of the legitimate exchange CoinSquare. The page masquerades as a login portal designed to harvest wallet credentials and seed phrases, with infrastructure engineered to drain funds immediately upon submission. No cryptocurrency drainer kit details are publicly available at this time, but behavioral analysis indicates real-time exfiltration to unknown wallets, consistent with automated crypto-stealing payloads.

This domain was flagged by PhishDestroy with a VirusTotal detection rate of 19/95 as of the latest scan, indicating it remains undetected by most antivirus engines. It resolves to IP address 172.64.151.8 and is hosted on Webflow’s platform under the *.webflow.io namespace. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy. The domain is registered through a privacy-protected registrar and shows recent creation, with no historical blocklist entries due to its low detection profile. The lack of detections suggests either a newly deployed campaign or one carefully designed to evade signature-based detection.

The campaign is currently active and under investigation, with a risk level classified as “under_investigation” due to evolving threat intelligence. PhishDestroy has issued a safety advisory and is tracking wallet exfiltration patterns. Users are urged to avoid accessing coiensquaarelogin.webflow.io and to verify any suspicious login links using PhishDestroy’s real-time verification tool. While the immediate risk is elevated for users entering credentials, the lack of detection underscores the need for proactive monitoring and rapid response. No remediation actions have been publicly confirmed by hosting providers, increasing exposure for potential victims.