coin-base-login-en[.]square[.]site

Analysis of coin-base-login-en.square.site confirms high-risk brand impersonation targeting Coinbase, a major cryptocurrency exchange. The domain, registered on February 5, 2019, was taken offline following detection by security vendors. Infrastructure analysis reveals hosting on Weebly, Inc. (AS27647) in the United States, resolving to IP 74.115.51.4. The domain is flagged by PhishDestroy and appears on one security blocklist, with Google Safe Browsing classifying it as social engineering. Thirteen of 95 security vendors on VirusTotal detect the domain as malicious, though the exact nature of the threat remains unverified beyond the provided indicators.

The page title, 'Coinbase - Buy and Sell Cryptocurrency Securely | Coin-Base-login,' explicitly mimics Coinbase branding, reinforcing the phishing classification. SSL certification is provided by Let's Encrypt (E7), a common tool for both legitimate and malicious sites, offering no conclusive trust signal. Technologies detected include Amazon Web Services and Cloudflare, which are frequently leveraged by threat actors to obscure infrastructure. The domain's nameservers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns) are consistent with AWS-hosted phishing campaigns.

While the domain currently returns a 404 HTTP status, indicating it is offline, defenders should treat any prior resolution as a confirmed threat. No evidence of credential harvesting or wallet-draining scripts is available from the provided data, but the combination of Coinbase branding, cryptocurrency focus, and social engineering flags aligns with typical crypto scam tactics. Organizations should block the domain at the DNS and proxy levels, and monitor for related infrastructure using the IP and ASN indicators. Further investigation into the domain's historical content and associated campaigns is recommended to assess the full scope of the threat.