coinsquareloginusa[.]webflow[.]io

coinsquareloginusa.webflow.io has been confirmed as an active credential-phishing site posing as the Coinsquare login portal. The page is engineered to harvest user email and password combinations, then exfiltrate stolen credentials to attacker-controlled servers. The risk level has been elevated to “elevated” due to the presence of a live login form, plausible branding, and the absence of any legitimate connection to Coinsquare or Webflow’s authentication services.

PhishDestroy’s telemetry shows the domain resolves to IP 172.64.151.8 and carries a Google Trust Services SSL certificate. VirusTotal scanning flags 5 out of 95 security vendors, indicating partial but not universal detection. The domain is hosted on Webflow’s *.webflow.io free-tier subdomain infrastructure, a common tactic to lend superficial legitimacy while remaining trivial for attackers to provision. No blocklist entries or historical takedown records are yet present, likely because the campaign launched within the last 24–48 hours. Creation date and registrar data are obscured by Webflow’s privacy-preserving registration, but the active presence of a working login interface confirms operational status.

To neutralize the threat, users must immediately block 172.64.151.8 at the firewall, disable or remove any saved bookmarks for coinsquareloginusa.webflow.io, and alert Coinsquare’s abuse team at abuse@coinsquare.com. Organizations should push IOC lists containing the domain and IP to endpoint protection and proxy solutions to prevent access. If credentials were entered, instruct users to rotate passwords, enable multi-factor authentication on Coinsquare, and revoke any active API keys or withdrawal permissions. Monitor for follow-on spear-phishing emails leveraging the stolen credentials, and report the domain to Google Safe Browsing and Webflow abuse channels for expedited deactivation.