learn-coincom-sign-in[.]square[.]site

This domain, learn-coincom-sign-in.square.site, is identified as a high-risk credential phishing site specifically targeting users of the Coinbase cryptocurrency exchange platform. Analysis indicates the domain mimics the official Coinbase sign-in interface, presenting a fraudulent login page titled 'Coinbase.com Sign In | Coinbase Help' to deceive users into submitting their authentication credentials. The primary threat involves the unauthorized capture of sensitive login details, which can lead to account takeovers, financial theft, and further exploitation through secondary phishing or malware distribution campaigns. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on February 05, 2019, through MarkMonitor, Inc., and resolves to the IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.) in the United States. Security vendors have flagged this domain as malicious, with 11 out of 95 engines on VirusTotal detecting it as phishing-related. Additionally, the domain appears on one security blocklist and is explicitly flagged by Google Safe Browsing as a phishing site. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encrypted connections to lend false legitimacy to the fraudulent page. Users who have visited learn-coincom-sign-in.square.site or entered credentials on this domain should take immediate remedial action. First, reset passwords for any accounts accessed through the site, prioritizing Coinbase and associated email accounts. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial transactions and account activity for signs of compromise, such as unauthorized logins or transactions. If credentials were entered, assume they have been compromised and avoid reusing passwords across platforms. Report the incident to the targeted brand’s security team for further investigation and potential takedown coordination. Users are advised to verify domain authenticity before entering credentials and to rely on official applications or bookmarked URLs for secure access.