web-sso-coinbase-app[.]square[.]site

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. The site mimics the Coinbase Pro login interface, attempting to deceive users into submitting their credentials under false pretenses of secure access. Analysis indicates this is a credential theft operation, not a generic phishing attempt, with a focus on cryptocurrency account compromise. Infrastructure analysis reveals the domain web-sso-coinbase-app.square.site was registered on February 05, 2019, through MarkMonitor, Inc., and currently resolves to the IP address 74.115.51.4, hosted on AS27647 (Weebly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (serial E7). Security vendor detections on VirusTotal show 20 out of 95 engines flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline. The page title, "Coinbase Pro Login | Secure Access to Your Crypto... | Coinbase pro login," directly impersonates Coinbase’s branding to enhance credibility. To mitigate risks associated with this brand impersonation threat, users should immediately revoke any credentials entered on this domain and enable multi-factor authentication (MFA) on their legitimate Coinbase accounts. Organizations should block the domain and its associated IP (74.115.51.4) at the network perimeter. Security teams are advised to monitor for indicators of compromise (IOCs), including the domain, IP, and SSL certificate serial E7, within their logs. Users should verify the authenticity of any login page by checking the URL and SSL certificate issuer before entering sensitive information. Awareness training should emphasize the risks of brand impersonation in cryptocurrency-related phishing attacks.