sso-coinbas-eng[.]square[.]site

Analysis of sso-coinbas-eng.square.site indicates a brand‑impersonation campaign targeting Coinbase users. The domain, created on February 5 2019 and registered through MarkMonitor, Inc., resolves to IP 74.115.51.4, an address owned by AS27647 Weebly, Inc. in the United States. The hosting infrastructure shows Amazon Web Services and Cloudflare services, consistent with a Weebly‑hosted site that leverages a Cloudflare front‑end for delivery. The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E7), confirming encrypted HTTPS support despite the underlying malicious intent. A request to the root URL returns HTTP 404, suggesting the original login page has been removed or hidden; no live content was captured at the time of analysis. The page title that was observed reads “Coinbase Pro Login | Secure Access to Your Crypto Account¥”, directly referencing Coinbase and employing a yen symbol, which aligns with the classified crypto‑scam vector.

Security telemetry shows the domain appears on one public blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans report that 13 of 95 antivirus and URL‑reputation engines flagged the domain, reinforcing the malicious classification. No additional intelligence sources such as OTX or Google Safe Browsing were cited in the provided data.

Defenders should treat the domain as high‑confidence malicious. Recommended actions include adding the domain and its resolving IP address to network‑level deny lists, updating email‑gateway URL filtering rules to block any references to “square.site” subdomains that mimic Coinbase branding, and monitoring for new subdomains registered under the same registrar that contain “coinbase” or “crypto” keywords. Given the use of a reputable registrar, threat actors may continue to exploit similar registration pathways, so ongoing scrutiny of newly observed Weebly‑hosted domains is advised.