learn-coins-pro-cdn[.]square[.]site

Analysis as of July 23, 2026 indicates that the domain learn-coins-pro-cdn.square.site is being used for a brand-impersonation campaign targeting Coinbase users. The domain was registered on February 5, 2019 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, suggesting that the attackers deliberately leveraged a reputable registrar to increase perceived legitimacy. DNS resolution points to the address 74.115.51.4, which belongs to AS27647 operated by Weebly, Inc. in the United States. The nameserver set includes ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com and ns-810.awsdns, confirming that the domain is hosted on Amazon Web Services infrastructure and fronted by Cloudflare. An SSL certificate issued by Let’s Encrypt (E7) is present, providing HTTPS encryption but offering no assurance of the site’s authenticity.

A HTTP request returned a 404 status, and the site is currently offline, limiting direct content analysis. However, the page title retrieved from prior scans reads “Coinbase™ Pro Login — Access Crypto Safely Anytime,” explicitly referencing the Coinbase brand and suggesting a credential-harvesting login façade. The campaign has been classified as a crypto scam and appears on a single security blocklist, with PhishDestroy confirming takedown. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 13 of 95 scanning engines have identified malicious behavior, reinforcing the suspicion of phishing activity. Defenders should treat the domain as high-risk.

Immediate actions include adding learn-coins-pro-cdn.square.site to network blocklists, configuring email gateways to reject messages containing URLs to the domain, and monitoring outbound connections to the IP 74.115.51.4 for any residual beaconing.