auth-io-coinsquare-cdn[.]webflow[.]io

This domain, auth-io-coinsquare-cdn.webflow.io, is identified as an active phishing resource specifically targeting users of the Coinsquare cryptocurrency exchange platform. The threat type is classified as a credential harvesting portal, designed to mimic the legitimate Coinsquare login interface to deceive users into submitting sensitive account information. The domain remains operational and poses an elevated risk to individuals interacting with cryptocurrency services. Analysis indicates the domain is registered through Webflow, a platform commonly used for web development and hosting. It resolves to the IP address 172.64.151.8, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain appears on one security blocklist and has been flagged by 17 out of 95 security vendors on VirusTotal, reflecting a moderate but notable level of detection. The page title, 'Coinsquare | Login,' directly mirrors the branding of the legitimate exchange, increasing the likelihood of successful deception. Current evidence confirms the domain remains active and continues to host the fraudulent login portal. Users are advised to avoid interaction with this domain and report it to relevant security teams. Organizations should update their web filtering rules to block access to auth-io-coinsquare-cdn.webflow.io and monitor for similar phishing attempts targeting cryptocurrency platforms. Multi-factor authentication and user education on recognizing phishing indicators are recommended to mitigate the risk of credential compromise.