bas-coin-login[.]square[.]site

Analysis of bas-coin-login.square.site indicates an active credential phishing infrastructure targeting users through a subdomain hosted on square.site. The domain, registered on February 5, 2019, resolves to IP address 74.115.51.5 and is currently flagged by at least one security blocklist, with PhishDestroy having already blocked access. The page title 'Just a moment...' suggests the use of Cloudflare protection or a similar intermediary service, which is consistent with the detected technologies, including Weebly, MySQL, PHP, and Vue.js. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Infrastructure analysis reveals the domain is proxied through Cloudflare, a tactic frequently employed to obscure hosting details and evade takedowns. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent. While 17 of 95 security vendors on VirusTotal have flagged this domain, the absence of additional context—such as the specific brand being impersonated or the phishing kit in use—limits deeper attribution. The domain's registration through MarkMonitor, Inc. does not inherently indicate malicious activity, as this registrar is widely used for both legitimate and fraudulent purposes. Defenders should treat this domain as a high-risk credential phishing endpoint. Immediate actions include blocking the domain and its resolving IP (74.115.51.5) at the network perimeter, monitoring for internal connections to this infrastructure, and alerting users to potential credential harvesting attempts. Given the domain's age and persistent activity, it is likely part of a broader campaign, and further investigation into related subdomains or IPs may uncover additional threats. The exact content of the phishing page remains unanalyzed, so defenders should prioritize containment and log review over speculative attribution.