coinsqurloginn[.]webflow[.]io

The domain coinsqurloginn.webflow.io was registered on January 21 2026 and is hosted on the Webflow platform behind Cloudflare’s network (AS13335) with the IP address 104.18.36.248 located in the United States. The site presents a page title of "Coinsquare® Login% | cryptocurrency exchange Account Access," indicating an attempt to masquerade as the Coinsquare exchange login portal. Infrastructure analysis shows the site employed Webflow, Cloudflare and HTTP/3, and presented an SSL certificate labeled WE1. HTTP response code 403 was observed, and the domain has since been taken offline, with PhishDestroy confirming the takedown.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and detection by 18 of 94 security vendors on VirusTotal. The domain appears on a single security blocklist and is currently blocked by PhishDestroy. No nameserver records were found, and the registrar information points to Webflow as the registration service.

While the page title and scam type (Fake Exchange) provide clear evidence of credential‑phishing intent targeting Coinsquare users, the lack of visible page content, URL paths, or payload details leaves the exact phishing mechanism uncertain. Defenders should add the domain to URL filtering and threat‑intel feeds, monitor for other Webflow‑hosted domains that reference Coinsquare or cryptocurrency exchanges, and enforce brand‑monitoring rules to detect similar impersonation attempts early. Continuous observation of Cloudflare‑originating IPs associated with phishing activity is recommended to pre‑empt future abuse.