coinsquuaarelogin[.]webflow[.]io

PhishDestroy identifies coinsquuaarelogin.webflow.io as an active credential-phishing domain impersonating the Coinbase login interface, likely serving as a crypto drainer kit to steal wallet credentials or authorization tokens. The domain is hosted on Webflow’s platform and is currently under investigation for malicious activity. No specific drainer kit has been confirmed, but the page’s structure closely mimics Coinbase’s official authentication flow, suggesting an attempt to harvest user credentials or session tokens for unauthorized crypto transfers. This domain exhibits the following technical indicators: a VirusTotal detection rate of 15/95, hosted on IP 172.64.151.8 via Cloudflare (172.64.0.0/13 range), and secured with a Google Trust Services SSL certificate. The domain is registered under Webflow’s infrastructure and was recently created, with no verified creation date available in public records. It has not been flagged by Google Safe Browsing (GSB) and remains unlisted on major blocklists, increasing its potential to deceive unsuspecting users. These traits indicate a recently deployed, low-profile phishing operation. As of this assessment, coinsquuaarelogin.webflow.io remains active and unblocked. Response actions include ongoing monitoring by PhishDestroy, but no takedown or blacklisting has occurred. The remaining risk is moderate due to the domain’s stealthy setup and lack of current detection. Users are strongly advised to verify the legitimacy of this site using PhishDestroy’s tools before interacting with any crypto-related login pages.