chrom-coinbse-extenson-us[.]square[.]site

The domain chrom-coinbse-extenson-us.square.site was observed returning HTTP 404 with the page title “Just a moment…”. VirusTotal records show that 6 of 95 scanning engines flagged the host, indicating a moderate detection consensus. Registration data list MarkMonitor, Inc. as the registrar and the domain was created on 05 Feb 2019. DNS resolves to 74.115.51.4, an address owned by AS27647 (Weebly, Inc.) located in the United States.

The name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com and ns-810.awsdns, confirming that the domain is hosted on Amazon Web Services infrastructure and front‑ended by Cloudflare. The TLS certificate is issued by Let’s Encrypt (E7), which is typical for short‑lived hosting. The site has been taken offline, yet it remains listed on at least one security blocklist and is actively blocked by the PhishDestroy feed.

Current evidence points to a generic phishing campaign using the “square.site” sub‑hosting platform, but the exact payload or targeted brand has not been disclosed. Defenders should continue to block the resolved IP address and the full domain, monitor any future DNS changes, and ensure that web filtering solutions reference the PhishDestroy indicator. Because the site is already offline, immediate incident response focus can shift to hunting for related C2 infrastructure or credential‑harvesting URLs that may share the same hosting profile or certificate chain.