coin-square-login-web-sso[.]typedream[.]app

Analysis of coin-square-login-web-sso.typedream.app indicates that the domain is being used for credential phishing targeting Coinsquare users, as evidenced by the page title "Login | Coinsquare® | Sign In to Your Account" and the classification of the scam type as Credential Phishing. The domain was registered through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 label, confirming that the site leveraged a legitimate‑looking HTTPS connection. Technical fingerprinting shows a stack consisting of Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare, and Webpack, all of which are consistent with a modern web application front‑end designed to mimic a legitimate login portal. The HTTP response returned a 403 status code, suggesting that the site was configured to block generic requests, which may be an attempt to evade automated crawling while still presenting content to targeted victims.

DNS resolution points to IP address 188.114.97.3, owned by AS13335 Cloudflare, Inc., located in the United States; the nameserver entry is listed as NS_NOT_FOUND, indicating that standard DNS records are either missing or deliberately obscured. Reputation signals are extremely poor: the domain appears on one security blocklist, is blocked by PhishDestroy, and received 15 detections out of 95 security vendors on VirusTotal, reinforcing the malicious assessment. Additionally, Scamadviser assigns a trust score of 1 out of 100, reflecting a near‑zero likelihood of legitimacy. The site is currently offline, which may indicate takedown or temporary suspension, but the infrastructure artifacts remain observable.

Defenders should continue to block the domain at perimeter filters, add the associated IP 188.114.97.3 to deny lists, and monitor for any resurgence of the same infrastructure under different hostnames.