help-coin-base-login-cdn[.]square[.]site

The domain help-coin-base-login-cdn.square.site is flagged for brand impersonation, specifically targeting the cryptocurrency platform Coinbase. The domain is currently active and poses a high risk to users who may be tricked into providing sensitive information.

Infrastructure analysis reveals that the domain is flagged by 17 of 95 VirusTotal vendors, indicating a significant level of suspicion among security experts. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 74.115.51.4, which is located in the United States and associated with AS27647 Weebly, Inc. The domain was created on February 5, 2019, and appears on 2 security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing also flags the domain as a phishing site. The SSL certificate is issued by Let's Encrypt, which does not imply endorsement but is a common feature of legitimate and malicious sites alike.

Given the current status and high-risk level, it is strongly recommended that users avoid interacting with this domain. Security teams should monitor for any associated activities and consider implementing additional network-level blocks to prevent access. Organizations and individuals should also educate their users about the dangers of brand impersonation and the importance of verifying the authenticity of websites, especially those purporting to be financial services platforms.