learn-version-pro-access[.]square[.]site

Analysis of learn-version-pro-access.square.site confirms its classification as a high-risk phishing domain targeting Square users. The domain, registered through MarkMonitor, Inc. on February 5, 2019, resolves to 74.115.51.5 (AS27647, Weebly, Inc., US-based hosting). Infrastructure analysis reveals the use of Amazon Web Services nameservers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns) and Cloudflare technologies, alongside a Let's Encrypt SSL certificate (serial E7). The domain was flagged by Google Safe Browsing for social engineering and appears on one security blocklist, including a block by PhishDestroy.

At the time of this report (July 23, 2026), the site returns an HTTP 404 status and is offline, though its prior page title, 'Just a moment...', aligns with Cloudflare interstitial pages often used to filter or delay access in phishing campaigns. Sixteen of 95 security vendors on VirusTotal detected the domain as malicious, though the specific payload or phishing kit remains unconfirmed. The subdomain structure ('learn-version-pro-access') suggests an attempt to mimic Square’s legitimate service portals, though no direct evidence of credential harvesting or payment diversion was observed in the available data.

Defenders should treat this domain as compromised infrastructure and block it at the DNS and network levels. Given the use of Square’s branding in the subdomain, organizations processing Square transactions should monitor for unauthorized access attempts linked to this domain. Further investigation into the hosting IP (74.115.51.5) may reveal additional related phishing sites, as Weebly and Square share infrastructure.