coinsqvereloggin[.]webflow[.]io

This domain is flagged for hosting a targeted crypto credential phishing page under the guise of a legitimate exchange platform. Analysis indicates the site specifically impersonates Coinsquare, a known cryptocurrency trading service, with the intent to harvest user login credentials, API keys, or two-factor authentication tokens. The threat type is classified as crypto credential phishing, with an elevated risk level due to the potential for financial loss and unauthorized account access. Infrastructure analysis reveals the domain coinsqvereloggin.webflow.io was registered through MarkMonitor, Inc. and currently resolves to IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious. The domain creation date is listed as March 06, 2026, which may indicate an attempt to evade detection by using a future-dated registration. It appears on one security blocklist and is currently blocked by PhishDestroy. The page title, 'Coinsquare* | Your Trustworthy Crypto Exchange...,' includes a subtle asterisk, a tactic often used to create a false sense of legitimacy while evading exact trademark matches. Mitigation steps for this specific threat include immediate blocking of the domain and its resolving IP (104.18.36.248) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain name, IP address, and SSL certificate issuer (Google Trust Services / WE1) into security monitoring systems to detect any internal access attempts. End users should be alerted to verify domain authenticity before entering credentials, particularly for financial or crypto-related services. If credentials were entered on this site, immediate password resets and revocation of API keys or session tokens are recommended. Security teams should monitor for follow-up attacks, such as phishing emails or SMS messages directing users to this domain, as part of a broader campaign.