coinbase-pro-logg-help[.]square[.]site

coinbase-pro-logg-help.square.site is registered through MarkMonitor, Inc. and was created on February 05, 2019. The domain resolves to IP 74.115.51.5, which belongs to AS27647 Weebly, Inc. and is geolocated in the United States. DNS is served by four Amazon Route 53 name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns). The web server is fronted by Amazon Web Services and protected by Cloudflare, and it presents a Let’s Encrypt certificate signed by the E7 intermediate.

HTTP requests return a 404 status code and the only observable page title is “Nur einen Moment…”, which provides no direct indication of the malicious payload. The site has been classified as a crypto‑scam that impersonates the Coinbase brand. Security telemetry shows the domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded detections from 12 of 95 scanning engines, and Google Safe Browsing flags the domain for social‑engineering content.

The combination of brand impersonation, cryptocurrency‑focused lure, and use of a reputable hosting provider suggests an attempt to lend credibility to the fraudulent page. Defenders should add the domain and its IP address to firewall and DNS filtering rules, confirm that any inbound or outbound traffic to the associated AWS/Cloudflare endpoints is denied, and monitor for similar square.site subdomains that reference Coinbase or other financial services. Because the site currently returns 404 and is offline, ongoing observation is advised to detect potential re‑hosting or migration to a new infrastructure. Evidence from the registrar, DNS configuration, SSL certificate, and threat‑intel feeds should be incorporated into incident response playbooks to accelerate detection of future replicas.