started-coenbese-logen-tn[.]square[.]site

This domain is flagged for elevated risk due to brand impersonation targeting Coinbase Pro users. The infrastructure is designed to mimic legitimate Coinbase Pro login portals, as evidenced by the page title "Official Site*Coinbase Pro Login* | Access Advanced Crypto Tools | Coinbase Pro Login," which closely resembles authentic Coinbase branding. Analysis indicates the domain is engineered to harvest cryptocurrency credentials, posing a direct financial threat to users who interact with it. Infrastructure analysis reveals the domain started-coenbese-logen-tn.square.site resolves to the IP address 74.115.51.4, hosted on Weebly, Inc. (AS27647) infrastructure. The domain was registered on February 05, 2019, through MarkMonitor, Inc., and currently holds an SSL certificate issued by Let’s Encrypt (identifier E7). It appears on one security blocklist and is flagged by 12 out of 95 security vendors on VirusTotal. The domain’s status is currently offline, though historical activity suggests prior malicious use. Mitigation steps for this threat type include immediate blocking of the domain and associated IP (74.115.51.4) at the network perimeter. Organizations should monitor for credential submission attempts to this domain in web proxy logs and educate users on recognizing phishing indicators, such as mismatched URLs or unofficial subdomains. Cryptocurrency platforms should implement multi-factor authentication (MFA) and transaction signing to mitigate the impact of credential theft. Security teams are advised to review historical DNS records for related subdomains under square.site and assess exposure to Weebly-hosted infrastructure for similar threats.