coibese-io-tn-help[.]square[.]site

The domain coibese-io-tn-help.square.site is flagged by multiple security sources as a high‑risk phishing infrastructure. It appears on one public blocklist and is actively blocked by PhishDestroy, indicating that defensive teams have already taken remediation steps. DNS resolution points to IP address 74.115.51.5, which is allocated to AS27647 (Weebly, Inc.) in the United States. The hosting environment is built on Amazon Web Services and further protected by Cloudflare, a combination frequently used to provide resilience and concealment for malicious actors.

The domain was registered on February 5, 2019 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, which may be leveraged to lend credibility to the malicious site. The SSL certificate is issued by Let’s Encrypt (identifier E7), providing HTTPS encryption without any indication of a trusted commercial certificate authority. A HTTP request to the site returns a 404 status, and the only visible page title is “Nur einen Moment…”, a German phrase meaning “Just a moment…”, suggesting that the content was either removed or never served before the takedown. Google Safe Browsing classifies the site under social engineering, reinforcing the phishing assessment.

VirusTotal scans report 16 detections out of 95 security vendors, confirming that the domain is recognized by a substantial portion of the security community as malicious. Because the site is currently offline, immediate impact is limited, but the infrastructure—particularly the shared IP and the AWS/Cloudflare stack—remains reusable for future campaigns. Defenders should continue to block the domain and its resolved IP, monitor the associated nameservers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns) for any new sub‑domains, and update URL filtering and intrusion detection signatures to capture any re‑use of this hosting profile.