dem-coinsqr-io[.]pages[.]dev

The domain dem-coinsqr-io.pages.dev has been identified as a brand impersonation threat specifically targeting the Bitcoin ecosystem by mimicking the Coinsquare login page. At the time of analysis, this domain is offline, but its history reveals a calculated attempt to harvest credentials from unsuspecting users. The page title, "Coinsquare Login 🔐 Sign In to Trade Bitcoin," was designed to deceive visitors into believing they were accessing a legitimate cryptocurrency trading platform.

Technical indicators paint a clear picture of the domain's malicious intent. It was flagged by 1 of 95 VirusTotal vendors, and it appears on one security blocklist. The domain was registered through Cloudflare, Inc. with a creation date of May 01, 2026, and it resolved to IP address 172.66.47.180. Its SSL certificate was issued by Google Trust Services (WE1), which adds a veneer of legitimacy to the fraudulent site. These details, combined with the seamless design of the phishing page, underscore the sophisticated nature of this campaign.

Given that the domain is now offline, the immediate risk is neutralized; however, users who may have encountered it previously should take precautionary measures. PhishDestroy recommends that anyone who visited dem-coinsqr-io.pages.dev and entered login credentials immediately change their passwords on the legitimate Coinsquare platform and enable two-factor authentication. Additionally, monitor accounts for any unauthorized activity and report the incident to the appropriate security teams. Staying vigilant against brand impersonation domains is crucial, especially in the cryptocurrency space where such attacks are common.