coinnsquareelogin[.]webflow[.]io

The domain coinnsquareelogin.webflow.io is flagged for credential phishing. It mimics the brand Coinsquare, a well-known cryptocurrency trading platform, and is suspected of using a drainer kit to siphon user credentials. The domain's infrastructure and threat indicators point to a sophisticated phishing operation aimed at compromising sensitive user data.

Infrastructure analysis reveals that the domain has been flagged by 18 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain is registered through Webflow and resolves to the IP address 172.64.151.8, which is located in the United States and is part of AS13335, owned by Cloudflare, Inc. The domain was created on March 03, 2026, and has been added to one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting users.

The domain is currently offline, which suggests that it has been taken down as part of a response to the detected threat. Despite this, the elevated risk level remains due to the potential for the domain to be reactivated. Organizations and users are advised to monitor their network traffic for any attempts to access this domain and to educate users on the risks of credential phishing. The domain's association with a reputable brand and the use of a valid SSL certificate highlight the importance of multi-layered security measures to prevent such attacks.