cnsqarrlognn[.]webflow[.]io

The domain cnsqarrlognn.webflow.io is currently active and has been classified as a high‑risk generic phishing site targeting cryptocurrency users. The page title observed, "Coinsquare® Login: Seamlessly Navigate Crypto Markets," indicates that the site is attempting to masquerade as the legitimate Coinsquare login portal. The domain was registered on March 22 2026 via the Webflow service and resolves to the IP address 104.18.36.248, which is owned by Cloudflare, Inc., and geolocated to Canada. The site serves content over HTTPS using a Google Trust Services certificate (WE1) and responds with HTTP status 200. Technical fingerprinting shows the use of Webflow, Cloudflare, and HTTP/3. VirusTotal analysis shows 17 of 91 security vendors flagging the domain, and it is listed on at least one public blocklist. Independent security services have assigned extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100) and PhishDestroy has already blocked the domain. While the exact page content has not been examined, the presence of a Coinsquare‑related title and the high detection rate suggest a credential‑harvesting operation. Defenders should add cnsqarrlognn.webflow.io to URL filtering and DNS block lists, monitor for related traffic to the Cloudflare‑hosted IP, and advise users to verify the authenticity of any Coinsquare login prompts. Continued observation is recommended to detect any changes in hosting, certificate, or content that could affect mitigation strategies.