coinbase-fr[.]site

Analysis of coinbase-fr.site indicates that the domain is being used for a cryptocurrency‑related scam impersonating Coinbase. The site was registered on December 5, 2025 through Go Daddy, LLC and is hosted on the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is provided by bonnie.ns.cloudflare.com and ray.ns.cloudflare.com, confirming the use of Cloudflare’s name‑server infrastructure. The page title returned by the HTTP response is "Sistema em Manutenção," and no SSL certificate is presented, meaning the site operates over plain HTTP.

Reputation checks show a Gridinsoft trust score of 0 out of 100 and a Google Safe Browsing classification of social engineering. Seven of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external security blocklist. PhishDestroy has also blocked the domain.

The combined evidence—registration details, hosting attribution, lack of encryption, low trust score, and multiple vendor detections—supports the conclusion that coinbase-fr.site is a confirmed crypto scam targeting users of Coinbase. The domain is currently offline, which limits immediate observation of payloads or redirect behavior. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and update threat‑intel feeds with the observed indicators of compromise, including the IP address, nameservers, and page title fingerprint.