Keamanan domain dan intelijen ancaman

coinsquuuarelogin.webflow.io

Name: coinsquuuarelogin.webflow.io — PhishDestroy evidence record
Published: 2026-09-11
License: https://creativecommons.org/licenses/by/4.0/

Ringkasnya

coinsquuuarelogin.webflow.io: Phishing kredensial, terdeteksi oleh PhishDestroy pada 2026-09-11.

“Coinsquare Login | Step Inside Your Crypto Realm”

Tinjau bukti

Registrar: MarkMonitor
Alamat IP: 104.18.36.248Cloudflare, Inc. · CDN
Terdaftar: 08/05/2013
Pertama kali teramati: 11/09/2026

Penilaian PhishDestroy Kritis

100/100

Skor bukti

Ketersediaan Konten tidak tersedia Konten tidak tersedia dalam observasi terbaru Teramati 27 Okt 2026 · 02:23 UTCPemeriksaan HTTP

Sinyal risiko

Deteksi Total Virus: 14/89 Daftar blokir yang disimpan cocok: 2 Label merek otomatis: Coinsquare Jenis penipuan: Phishing Kredensial Google Safe Browsing: tanda ancaman tercatat

VirusTotal

14 / 89

deteksi mesin · 2026-09-12

Google Safe Browsing

Ditandai

Pertandingan dalam daftar blokir

MetaMask, SEAL

URLQuery

deteksi

URLScan

Berbahaya

Tangkapan halaman

buka galeri

Usia domain

4.920 hari

Ringkasan laporan

Phishing kredensial: coinsquuuarelogin.webflow.io — Konten tidak tersedia (HTTP 404). Ringkasan bukti: VirusTotal 14/89 (ChainPatrol, BitDefender, ESET…

Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.

Analisis

Ringkasan domain

coinsquuuarelogin.webflow.io: Phishing kredensial, terdeteksi oleh PhishDestroy pada 2026-09-11. Risiko: kritis (100/100). Registrar: MarkMonitor. Status: Konten tidak tersedia. Hosting: CLOUDFLARENET - Cloudflare, Inc., US. VirusTotal: 14/89 mesin menandainya. Google Safe Browsing menandainya berbahaya. Jangan masukkan kredensial dan jangan hubungkan dompet.

Kritis

Status: Konten tidak tersedia
VirusTotal: 14 / 89
Pertandingan dalam daftar blokir: 2
Jenis penipuan: Phishing Kredensial
Layanan Hosting: 104.18.36.248Cloudflare, Inc. · CDN
Registrar: MarkMonitor
Terdaftar: 08/05/2013
Tangkapan halaman: 10

Tangkapan halaman Hasil sumber Catatan pendaftaran

Laporan Ancaman PhishDestroy2026-10-19 10:19:33 UTC

Overview

coinsquuuarelogin.webflow.io was a fake Coinsquare sign-in page aimed at customers of the crypto exchange. It ran under the title "Coinsquare Login | Step Inside Your Crypto Realm". The tripled "u" in the subdomain is meant to pass a quick glance. PhishDestroy first flagged it on 2026-09-11. The site has been offline since 2026-09-15, and on our latest check on 2026-10-19 the root returned no content.

How the scam works

The page copies the Coinsquare login screen and waits for victims to type in their email and password, often arriving from a search ad, social post or email that promises account access. Whatever is entered goes straight to the operators. They can then log into the real Coinsquare account, try the same password on other services, and attempt withdrawals before the owner notices. If the fake page also asks for a 2FA code, that code can be relayed in real time to defeat the second factor.

Bukti

Fourteen of 89 VirusTotal engines flagged the site on 2026-09-12. They included the crypto-focused ChainPatrol alongside BitDefender, ESET, Emsisoft, Fortinet, G-Data, Google Safe Browsing and Gridinsoft. Google Safe Browsing classifies it as social engineering, which is the category browsers use for deceptive login pages. urlscan.io returned a malicious verdict and recognised Coinsquare branding on the page. The domain is also listed on the PhishDestroy, MetaMask and SEAL blocklists.

Infrastruktur

The operators did not register a domain of their own. They built the page on a free subdomain of Webflow's site-builder platform. The 2013-05-08 registration date and the MarkMonitor, Inc. registrar belong to the parent webflow.io domain, not to the phishing operation. Traffic was served through Cloudflare's network in the US, which is standard for Webflow-hosted sites. This throwaway setup costs nothing and lets the operators move to a new subdomain as soon as one is taken down.

What to do

If you entered your details on this page, sign in to Coinsquare through its official app or a saved bookmark, change your password immediately and reset two-factor authentication. Review recent logins, withdrawals and whitelisted addresses, and contact Coinsquare support about anything you do not recognise. Change the password anywhere else you reused it. Security teams should block this hostname and watch for exchange brand names with doubled or tripled letters on free website-builder subdomains, reporting any new copies to the hosting platform.

Tautan yang berguna

urlscan.io scan and screenshot Laporan VirusTotal Google Safe Browsing status Archived copy Report phishing to Google Site owner? Request a review

Bukti sumberVirusTotal 14 / 89 · Google Safe Browsing: flagged 10 sumber

VirusTotal

14 / 89 deteksi mesin · ringkasan yang tersimpan

2026-09-12 02:17 UTC

Buka laporan

VirusTotalCatatan asli sumberTeramati: 2026-10-12 11:12:05 UTC15 kolom

Teramati: 2026-10-12T11:12:05Z · Diambil: 2026-10-22T16:21:16Z

Jumlah hasil vendor

Waktu habis: 0
Tidak berbahaya: 44
Berbahaya: 18
Mencurigakan: 0
Tidak terdeteksi: 30

Label pemasok

ESET: phishing
VIPRE: phishing
G-Data: phishing
Lionic: phishing
Sophos: phishing
Webroot: malicious
Emsisoft: phishing
Fortinet: phishing
Netcraft: malicious
URLQuery: malicious
Kaspersky: phishing
Gridinsoft: phishing
MalwareURL: phishing
BitDefender: phishing
ChainPatrol: malicious
alphaMountain.ai: phishing
Google Safe Browsing: phishing
Forcepoint ThreatSeeker: phishing

Skor reputasi

Kategori

Sophos: phishing and fraud
Webroot: Phishing and Other Frauds
alphaMountain.ai: Phishing (alphaMountain.ai)
Forcepoint ThreatSeeker: web hosting

Registrar

MarkMonitor Inc.

Dibuat

2013-05-08 02:20:57 UTC

Berlaku hingga

2028-05-08 02:20:57 UTC

Diperbarui

2026-08-12 04:04:30 UTC

Pertama terlihat

2024-03-05 10:31:22 UTC

Catatan DNS

TTL, detik
300
Jenis
A
Nilai
104.18.36.248
TTL, detik
300
Jenis
A
Nilai
172.64.151.8
TTL, detik
300
Jenis
AAAA
Nilai
2a06:98c1:3102::ac40:9708
TTL, detik
300
Jenis
AAAA
Nilai
2a06:98c1:3105::6812:24f8

Waktu pengambilan catatan DNS

2026-10-12 11:12:28 UTC

Sidik jari JARM

27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6

Sertifikat

Nama alternatif subjek (SAN): webflow.io
*.webflow.io
Penerbit: Google Trust Services / WE1
Nomor seri: ac972ef95a18ab8f0e5a2917e958d6da
SHA-256: 5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7
Subjek: webflow.io
Berlaku hingga: 2026-12-21 03:46:57 UTC
Berlaku sejak: 2026-09-22 02:47:08 UTC

Catatan pendaftaran

Registrar: MarkMonitor Inc.
ID IANA registrar: 292
URL registrar: http://www.markmonitor.com
Terdaftar: 2013-05-08 02:20:57 UTC
Diperbarui: 2025-02-25 20:53:31 UTC
Berlaku hingga: 2028-05-08 02:20:57 UTC
Status: clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
Server nama: journey.ns.cloudflare.com
lamar.ns.cloudflare.com
DNSSEC: unsigned

Kolom asli sumber · JSON

Jumlah hasil vendor	{ "timeout": 0, "harmless": 44, "malicious": 18, "suspicious": 0, "undetected": 30 }
Label pemasok	{ "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "URLQuery": "malicious", "Kaspersky": "phishing", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "ChainPatrol": "malicious", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputasi	0
Tag	[ "dga" ]
Kategori	{ "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "web hosting" }
Registrar	MarkMonitor Inc.
Dibuat	2013-05-08T02:20:57Z
Berlaku hingga	2028-05-08T02:20:57Z
Diperbarui	2026-08-12T04:04:30Z
Pertama terlihat	2024-03-05T10:31:22Z
Catatan DNS	[ { "ttl": 300, "type": "A", "value": "104.18.36.248" }, { "ttl": 300, "type": "A", "value": "172.64.151.8" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ]
Dns at	2026-10-12T11:12:28Z
Jarm	27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6
Sertifikat	{ "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "ac972ef95a18ab8f0e5a2917e958d6da", "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7", "subject": "webflow.io", "valid_to": "2026-12-21T03:46:57Z", "valid_from": "2026-09-22T02:47:08Z" }
Catatan pendaftaran	{ "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" }

Catatan sumber terpisah · 18 malicious + 0 suspicious / 92 · 2026-10-12 11:12:05 UTC

Ringkasan di atas dan catatan penyedia ini dikumpulkan pada waktu yang berbeda. Keduanya tetap tersedia; klasifikasi berbahaya dan mencurigakan ditampilkan secara terpisah.

record_source: collected_observations.vt
analysis_at: 2026-10-12T11:12:05Z
fetched_at: 2026-10-22T16:21:16Z
stats: {"timeout":0,"harmless":44,"malicious":18,"suspicious":0,"undetected":30}

URLQuery

5 det.

Buka laporan

Scamadviser

15/100

Buka laporan

Google Safe Browsing

Tanda ancaman tercatat

2026-09-14 04:00 UTC

Buka laporan

URLScan

Berbahaya

2026-09-11 16:06 UTC

Buka laporan

URLScanCatatan asli sumberTeramati: 2026-09-11 16:06:18 UTC19 kolom

Teramati: 2026-09-11T16:06:18Z · Diambil: 2026-10-21T00:18:49Z

ID laporan

01a09138-2c2d-7716-a04d-991033b87049

URL Akhir

https://coinsquuuarelogin.webflow.io/

Respons HTTP

200

Alamat IP

172.64.151.8

Domain yang dihubungi

cdn.prod.website-files.com
d3e54v103j8qbb.cloudfront.net

Alamat IP yang dihubungi

13.226.247.18
104.18.160.117
172.64.151.8

Sistem otonom (ASN)

16509
13335

Negara server

Domain yang tertaut

konsqure.keplr-wallet.xyz

Hash dokumen

38daa85d1b85a2025bfa7e8984ca28bfdf5fda6eb5928102224597e6d1000483

Variabel global JavaScript

$
jQuery
tram
Webflow

Sesi TLS dan sertifikat

Nama alternatif subjek (SAN): webflow.io
*.webflow.io
Cipher suite: AES_128_GCM
Penerbit: WE1
Subjek: webflow.io
Protokol: QUIC
Berlaku hingga: 2026-10-23 03:21:05 UTC
Berlaku sejak: 2026-07-25 02:21:21 UTC

Usia domain, hari

Usia domain terdaftar, hari

Usia sertifikat, hari

Masa berlaku sertifikat, hari

Permintaan halaman

Keputusan penyedia layanan

Putusan mesin

Tag: urlscan-ml
urlscan-ml-60c5e22
Skor: 99
Berbahaya: Ya

Putusan keseluruhan

Tag: phishing
Skor: 100
Merek: coinsquare
Berbahaya: Ya
Kategori: phishing

Putusan URLScan

Tag: phishing
Skor: 100
Merek: Coinsquare
Berbahaya: Ya
Kategori: phishing

Header HTTP

Server: cloudflare
Content-type: text/html; charset=utf-8
Content-security-policy: frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Kolom asli sumber · JSON

Uuid	01a09138-2c2d-7716-a04d-991033b87049
Final url	https://coinsquuuarelogin.webflow.io/
Status	200
Ip	172.64.151.8
Domain yang dihubungi	[ "cdn.prod.website-files.com", "d3e54v103j8qbb.cloudfront.net" ]
Alamat IP yang dihubungi	[ "13.226.247.18", "104.18.160.117", "172.64.151.8" ]
Asns	[ "16509", "13335" ]
Countries	[ "US" ]
Domain yang tertaut	[ "konsqure.keplr-wallet.xyz" ]
Hash dokumen	38daa85d1b85a2025bfa7e8984ca28bfdf5fda6eb5928102224597e6d1000483
Globals	[ "$", "jQuery", "tram", "Webflow" ]
Tls	{ "san": [ "webflow.io", "*.webflow.io" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "webflow.io", "protocol": "QUIC", "valid_to": "2026-10-23T03:21:05Z", "valid_from": "2026-07-25T02:21:21Z" }
Usia domain (hari)	0
Apex age days	0
Tls age days	48
Masa berlaku TLS (hari)	90
Permintaan	6
Keputusan penyedia layanan	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "coinsquare" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Coinsquare" ], "malicious": true, "categories": [ "phishing" ] } }
Header HTTP	{ "server": "cloudflare", "content-type": "text/html; charset=utf-8", "content-security-policy": "frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com" }

Catatan monitor terpisah · 2026-09-12 03:30 UTC

Cuplikan monitor yang disimpan secara terpisah; tidak menggantikan catatan laporan utama atau menentukan ketersediaan saat ini.

record_source: domain_monitor.urlscan
uuid: 01a09138-2c2d-7716-a04d-991033b87049
report_url: https://urlscan.io/result/01a09138-2c2d-7716-a04d-991033b87049/
skor: 100
malicious: true
result_at: 2026-09-12T03:30:05Z
enriched_at: 2026-09-12T08:11:10Z
source_timestamps: {"urlscan_result_at":"2026-09-12 05:30:05","urlscan_enriched_at":"2026-09-12 10:11:10"}
timestamp_basis: Eropa/Berlin, sebagaimana digunakan dalam laporan yang ada; cap waktu sumber dipertahankan apa adanya

OTX

tidak ada referensi komunitas

2026-09-11 17:15 UTC

Buka laporan

Cloudflare Radar

provider verdict: clean

Buka laporan

Cloudflare RadarCatatan asli sumberTeramati: 2026-09-11 17:15:39 UTC11 kolom

Teramati: 2026-09-11T17:15:39Z · Diambil: 2026-10-21T02:31:51Z

ID laporan

a66ca676-0c3e-41f1-b1f0-62e31f81ff8e

URL Akhir

https://coinsquuuarelogin.webflow.io/

Respons HTTP

200

Riwayat navigasi

URL
https://coinsquuuarelogin.webflow.io/
Status
200

Hash struktur DOM

cf05b541b44efee86d54a1b2d5934bdf0564ff29070e2b827c29930d2a4555d8

Hash dokumen

38daa85d1b85a2025bfa7e8984ca28bfdf5fda6eb5928102224597e6d1000483