ca-coinsquree-cdn--auths[.]webflow[.]io

Analysis of the domain ca-coinsquree-cdn--auths.webflow.io indicates active credential phishing targeting the Coinsquare platform. The domain, registered on March 6, 2026, presents a page titled 'Coinsquare | Login,' consistent with a credential harvesting attempt. It resolves to IP 104.18.36.248 (AS13335, Cloudflare, Inc., US) and returns an HTTP 200 status, suggesting the phishing page remains operational. SSL certification is provided by Google Trust Services (WE1), a common tactic to appear legitimate. The domain is flagged by 17 of 94 security vendors in aggregated scans and appears on one security blocklist, with a trust score of 0/100. Infrastructure analysis reveals registration through Webflow, a platform frequently abused for rapid deployment of phishing sites. No evidence of additional payloads or lateral movement vectors has been confirmed at this time. Defenders should treat this domain as high-risk and prioritize blocking at the DNS or network level. Given the use of Cloudflare infrastructure, monitoring for related subdomains or IP shifts is recommended. The exact phishing kit or backend infrastructure remains unconfirmed, but the page title and scam type explicitly indicate credential theft targeting Coinsquare users. No further brand impersonation or scam categorization beyond the provided data is warranted.