learn-sso-coins-com[.]square[.]site

Analysis of learn-sso-coins-com.square.site indicates a high‑risk brand‑impersonation campaign targeting Coinbase. The domain resolves to IP 74.115.51.4, which belongs to AS27647 Weebly, Inc. in the United States. The web server returned HTTP 404, and the TLS certificate is issued by Let’s Encrypt (E7) covering the *.square.site sub‑domain. DNS is served by four Amazon Route 53 name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns). The site is built on Amazon Web Services and also uses Cloudflare as a front‑end CDN, as indicated by technology fingerprints. Google Safe Browsing classifies the URL as “social engineering,” and the domain appears on one external security blocklist.

VirusTotal recorded 16 detections out of 95 scanning engines, confirming malicious intent. The domain is listed as blocked by PhishDestroy. Registration was performed through MarkMonitor, Inc., a registrar frequently used for legitimate brand assets, and the domain was created on 5 February 2019. The page title returned by the server explicitly references Coinbase’s marketing copy ("Coinbase - Buy and Sell Bitcoin, Ethereum"), confirming the intent to impersonate the cryptocurrency exchange. The current operational status is offline, which may indicate the campaign has been taken down or is being rotated.

Uncertainty remains regarding the exact payload delivered when the site was active; the HTTP 404 response prevents direct observation of the content, and no visual or form details are available. The presence of both AWS and Cloudflare suggests the operator can quickly relocate the malicious site to new infrastructure. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the listed name servers, and add the IP address 74.115.51.4 to reputation lists.