coinsquarelogin-new[.]webflow[.]io

This domain has been identified as an active threat with an elevated risk level related to credential theft. The site, coinsquarelogin-new.webflow.io, appears to be a targeted phishing attempt impersonating a legitimate login interface to harvest user credentials, specifically targeting users of a crypto exchange brand.

The domain coinsquarelogin-new.webflow.io was created on April 07, 2026, and is registered through Webflow. It currently resolves to the IP address 104.18.36.248. The domain's activity has been detected and flagged by 15 out of 95 security vendors on VirusTotal, indicating a significant risk. Additionally, the domain is on 1 known security blocklist. The SSL certificate for the domain is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. This infrastructure is currently blocked by a security entity known as PhishDestroy.

To mitigate this threat, it is crucial to implement multi-layered security measures. Users should verify URLs before entering credentials, particularly for sensitive accounts such as those related to financial services. Security teams should incorporate domain monitoring to track and block access to known malicious infrastructure sites. Additionally, using browser-based phishing protection extensions and conducting regular security awareness training can help users recognize deceptive tactics commonly employed by phishing campaigns. Lastly, ensuring that anti-phishing policies are updated and enforced can thwart potential attacks from this domain.