explore-pro-guite[.]square[.]site

The domain explore-pro-guite.square.site is identified as a high-risk brand impersonation threat targeting Coinbase, specifically mimicking the Coinbase Pro login interface. Analysis indicates this domain is designed to deceive users into submitting cryptocurrency exchange credentials through a fraudulent portal titled 'Coinbase Pro Login — Access Crypto Safely Anytime (Now …)'. The domain is currently offline, but prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was registered on February 05, 2019, through MarkMonitor, Inc., and resolves to the IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.) in the United States. Detection metrics show the domain appears on one security blocklist, with Google Safe Browsing explicitly flagging it as phishing. VirusTotal reports 13 of 95 security vendors detecting the domain as malicious, while an SSL certificate issued by Let's Encrypt (serial number E7) was used to lend a false sense of legitimacy. The registrar and hosting provider combination aligns with patterns observed in credential-harvesting campaigns. As of the latest assessment, explore-pro-guite.square.site has been taken offline, likely due to enforcement actions or takedown requests. However, users who previously interacted with the domain should assume credential compromise and take immediate remediation steps. It is recommended to reset passwords for Coinbase and any other accounts where identical credentials may have been reused. Organizations should update blocklists to include the domain and associated IP (74.115.51.5) to prevent future access. Monitoring for similar impersonation domains registered through MarkMonitor or hosted on Weebly infrastructure is advised, given the recurring use of these providers in phishing operations.