secure-coinbase-pro-cdn[.]square[.]site

Analysis of secure-coinbase-pro-cdn.square.site shows a high‑risk credential phishing infrastructure that remains active as of August 06, 2026. The domain is registered through Square, Inc., and resolves to the IPv4 address 74.115.51.5. DNS resolution does not return any nameserver records (NS_NOT_FOUND), which may indicate a misconfiguration or deliberate concealment of the authoritative name servers.

VirusTotal data reports that 10 of 91 security vendors have flagged the domain, providing independent confirmation of malicious intent. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the assessment that it is being used for phishing operations. No additional intelligence such as SSL certificate details, HTTP response codes, or page title information is currently available, leaving the precise content and delivery mechanisms unverified.

Defenders should treat traffic to this domain as hostile: network perimeter controls should block DNS resolution or HTTP(S) requests to 74.115.51.5, and endpoint security solutions should incorporate the domain into URL filtering rules. Continuous monitoring of the IP address and any associated subdomains is advised, as the infrastructure may be expanded or shifted. Given the active status and vendor detections, immediate remediation and ongoing vigilance are warranted to prevent credential compromise.