login-coinsquaren[.]webflow[.]io

PhishDestroy identifies login-coinsquaren.webflow.io as an active credential-phishing domain impersonating the crypto exchange CoinSquare. The fraudulent site leverages a Webflow subdomain to host a replica login portal designed to harvest user credentials and crypto wallet private keys. This campaign is consistent with modern drainer-kit tactics that automate fund extraction shortly after credentials are submitted.

Technical indicators for this domain include a VirusTotal detection score of 5/95 security vendors, hosted on IP 104.18.36.248, and secured by a Google Trust Services SSL certificate. The domain was registered through a privacy-protected registrar and shows minimal historical activity, suggesting recent creation and deployment. Google Safe Browsing has not yet blacklisted this domain, but community blocklists such as PhishTank and OpenPhish have already flagged it multiple times within 24 hours of discovery.

At the time of analysis, this domain is actively serving a malicious login page and remains unblocked by default in most browsers. Users attempting to access CoinSquare via this link risk immediate credential theft and potential crypto fund loss. PhishDestroy recommends blocking the IP 104.18.36.248 and domain login-coinsquaren.webflow.io at the network or DNS level. Affected users should rotate passwords, revoke browser-saved sessions, and check for unauthorized transactions on their CoinSquare accounts. The elevated risk level and lack of full blocklist coverage indicate this threat is evolving; continuous monitoring and proactive threat hunting are strongly advised.