conbese-pro-logen-tn-start[.]square[.]site

Analysis dated July 24, 2026 identifies conbese-pro-logen-tn-start.square.site as an elevated‑risk brand‑impersonation domain targeting Coinbase users. The site is currently offline, returning HTTP 404, and has been taken down by the PhishDestroy takedown service. Infrastructure inspection shows the domain resolves to IP address 74.115.51.4, hosted in the United States and attributed to ASN 27647 (Weebly, Inc.). The host infrastructure lists Amazon Web Services and Cloudflare as underlying platforms, and the domain is served with a valid Let's Encrypt certificate (E7).

Registration records indicate the domain was created on February 5, 2019 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection. DNS configuration uses four AWS name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns). Threat intelligence sources reveal the page title "Coinbase Pro Login: Step‑by‑Step Guide | Coinbase Pro Login," confirming the intent to masquerade as a Coinbase login guide. VirusTotal scans report five of ninety‑five security vendors flagging the domain, and it appears on one external blocklist.

The domain is classified as a crypto‑scam, consistent with the impersonation of a cryptocurrency exchange. While the offline status prevents direct verification of malicious payloads, the combination of brand‑specific page title, hosting on a known web‑builder platform, and detection by multiple security vendors supports a high confidence assessment of malicious intent. Defenders should block the domain and its resolving IP at network perimeters, add the observed nameservers to monitoring lists, and watch for any revival of the domain or related sub‑domains. Continuous OSINT monitoring of the registrar and hosting provider is advised to catch potential re‑registration attempts.