koinbase-crypto[.]square[.]site

The domain koinbase-crypto.square.site is actively engaged in crypto drainer operations targeting users of the cryptocurrency exchange Coinbase. This infrastructure is classified as a high-risk brand impersonation threat, designed to deceive victims into connecting wallets or entering credentials under the guise of legitimate Coinbase services. As of the latest verification, the domain remains operational and unmitigated. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on February 22, 2026, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and fraudulent activity. It resolves to the IP address 74.115.51.4 and is flagged by 13 of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice for threat actors due to its free and automated issuance process. Detected technologies include Weebly, MySQL, PHP, Vue.js, reCAPTCHA, and Cloudflare, suggesting a sophisticated backend infrastructure designed to evade detection and facilitate fraudulent transactions. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious classification. Current assessment indicates this infrastructure poses a significant risk to users, particularly those unfamiliar with phishing tactics or cryptocurrency security. The use of a subdomain under square.site may lend an appearance of legitimacy, while the inclusion of reCAPTCHA and Cloudflare could mislead victims into believing the site is secure. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Cryptocurrency exchanges and wallet providers are encouraged to preemptively warn users about this specific threat and implement real-time detection for similar impersonation patterns.