ca-coinsqaure-new[.]webflow[.]io

This domain, ca-coinsqaure-new.webflow.io, is identified as a credential theft phishing site impersonating Coinsquare, a cryptocurrency exchange platform. Analysis indicates the site was designed to harvest login credentials from unsuspecting users by mimicking the legitimate Coinsquare login interface, as evidenced by the page title 'Coinsquare | Login.' No direct evidence of a crypto drainer kit was observed, but the credential theft mechanism poses significant risk for subsequent unauthorized account access and financial theft. Infrastructure analysis reveals the domain was created on February 21, 2026, and is registered through NameCheap, Inc. It resolves to the IP address 104.18.36.248, hosted on Cloudflare's network (AS13335) in the United States. The domain is flagged by 13 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is commonly exploited by phishing sites to appear legitimate. Google Safe Browsing (GSB) does not currently list this domain, but the elevated detection rate on VirusTotal suggests a credible threat. As of the latest assessment, the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for similar attacks. Users who may have interacted with this domain are advised to reset their Coinsquare credentials immediately and enable multi-factor authentication (MFA) on all financial accounts. Organizations should monitor for indicators of compromise (IOCs) associated with this domain, including the IP address 104.18.36.248 and the SSL certificate issuer, to detect potential follow-up attacks or related malicious activity.