project-nav-cnbase-logn[.]square[.]site

The domain project-nav-cnbase-logn.square.site was observed hosting a page titled “Coinbase Pro Login | Secure Access to Your Crypto | Coinbase pro login”, indicating an attempt to impersonate Coinbase’s trading platform. The site is registered through MarkMonitor, Inc. and was created on 5 February 2019. Infrastructure analysis shows the domain resolves to IP 74.115.51.5, which belongs to AS27647 (Weebly, Inc.) in the United States. The hosting environment utilizes Amazon Web Services and is fronted by Cloudflare, as indicated by the presence of four AWS Route 53 nameservers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns).

A Let's Encrypt certificate (E7) is active, but the HTTP response is a 404 error, suggesting the malicious page has been removed or taken offline. VirusTotal scans returned 16 positive detections out of 95 scanners, and the domain appears on at least one public blocklist and is listed by PhishDestroy. The page title and the “Crypto Scam” classification confirm the intent to harvest credentials for Coinbase’s services.

At present, the site is offline, limiting immediate victim exposure, but the infrastructure components remain active and could be repurposed for future campaigns. Defenders should continue to block the domain at DNS and gateway layers, monitor the associated IP and AWS/Cloudflare assets for re‑use, and update detection signatures to flag the specific page title and SSL fingerprint. Ongoing threat‑intel feeds should be checked for any re‑registration attempts or new indicators that reuse the same hosting profile.