coinsqure-ca-auth[.]webflow[.]io

This domain is assessed as an ELEVATED risk and is associated with credential theft activity impersonating a financial login portal. The page is designed to mimic a legitimate authentication interface and likely aims to capture user credentials such as email, passwords, and potentially secondary verification data. The threat is characterized by brand imitation and deceptive login presentation.

Analysis indicators show VirusTotal detection at 20/95 security vendors, domain creation date April 19, 2026, and registration through Webflow. The infrastructure resolves to IP 104.18.36.248 with geolocation in CA (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services / WE1. The page title is Coinsquare | Login, and the domain appears on 1 security blocklist including PhishDestroy. Current status indicates the domain has been taken offline.

If a user interacted with this site, credentials should be considered compromised. Immediate response should include password reset on any potentially reused credentials across financial platforms, enablement of multi-factor authentication, and review of account activity for unauthorized access. Endpoint scanning is recommended to ensure no persistent malware or session token theft occurred. Security teams should block the domain and associated IP 104.18.36.248, monitor Webflow-hosted subdomain abuse patterns, and update threat intelligence feeds to prevent recurrence of similar credential harvesting infrastructure.