auth-coinsquare[.]webflow[.]io

auth-coinsquare.webflow.io is currently listed as an active high‑risk phishing infrastructure. The domain has been blocked by the PhishDestroy network and is flagged by Google Safe Browsing for “social engineering”. VirusTotal reports that 13 of 91 scanning engines have raised detections against the host, and it appears on one external security blocklist. The site resides on a Webflow.io sub‑domain, a legitimate SaaS platform used for static site hosting, which can make traditional network‑level indicators less obvious.

No public registrar information, IP address, SSL certificate details, HTTP response codes, or page‑title metadata have been released in the available intelligence, so the underlying hosting characteristics remain unclear. Likewise, the specific phishing kit, targeted brand, or credential‑capture mechanism have not been disclosed. Defenders should immediately add auth‑coinsquare.webflow.io to DNS and URL filtering policies, ensure endpoint web‑filter products reference the latest Google Safe Browsing and PhishDestroy feeds, and monitor outbound traffic for connections to the Webflow hosting range originating from internal users.

Because the domain leverages a reputable content‑delivery service, deeper inspection of TLS handshakes and HTTP headers may be required to differentiate malicious content from benign Webflow sites. Continuous threat‑intel feeds should be consulted for any future attribution of the phishing kit or expanded blocklist entries. Organizations are advised to educate users about unsolicited login prompts that reference unfamiliar “CoinSquare” phrasing and to enforce multi‑factor authentication to mitigate potential credential compromise.