learn-coinbasecom-sign-en[.]square[.]site

Analysis indicates that the domain learn-coinbasecom-sign-en.square.site was provisioned on February 5 2019 and is currently registered through MarkMonitor, Inc. The authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns, confirming that the domain is hosted on Amazon Web Services and front‑ended by Cloudflare. DNS resolution points to IP 74.115.51.5, which belongs to AS27647 (Weebly, Inc.) and is geolocated in the United States. The site presents an SSL certificate issued by Let’s Encrypt (E7) and returns an HTTP 404 status with the page title “Just a moment…”.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 15 positive detections out of 95 scanned security vendors. The domain also appears on a single public blocklist and has been flagged by PhishDestroy. The threat vector is identified as a crypto‑scam that impersonates the Coinbase brand, consistent with the “brand impersonation” label in the intelligence.

Because the service is currently taken offline, the exact malicious payload or credential‑stealing page cannot be verified, and the “Just a moment…” title provides no further insight into the content that was served. Defenders should continue to block the domain at network perimeter and DNS layers, add the IP address 74.115.51.5 to host‑based deny lists, and monitor for any future re‑registration of similar sub‑domains on the same name‑server set. Ongoing threat‑intel feeds should be consulted for updated detection signatures, and any residual traffic observed from compromised clients should be investigated for credential exposure related to the Coinbase brand.