trading-coinsquare[.]webflow[.]io

The domain trading-coinsquare.webflow.io is identified as a generic phishing threat, designed to impersonate the Coinsquare brand. The fraudulent website aimed to deceive users into providing sensitive credentials under the guise of legitimate account access. Although no specific drainer kit was identified, the site's mimicry of a recognized brand increases the likelihood of successful phishing attempts.

Technical analysis reveals key indicators of malicious activity. The domain was registered through Webflow and resolves to the IP address 104.18.36.248, located in Canada under Cloudflare, Inc.'s infrastructure. According to VirusTotal, 20 out of 95 security vendors flagged this domain as malicious. The domain's SSL certificate is issued by Google Trust Services / WE1, which could mislead users into assuming a legitimate security posture. The domain appears on one security blocklist and was specifically blocked by PhishDestroy.

Currently, trading-coinsquare.webflow.io has been taken offline, mitigating the immediate threat. However, the domain's previous presence in phishing campaigns warrants continued vigilance. Users are advised to remain cautious of similar domains and verify URLs before entering login credentials. Ensuring robust security measures, such as two-factor authentication and regular monitoring of account activity, can further mitigate risks associated with phishing attacks.