franklincoin[.]trade

This domain, franklincoin.trade, is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. The domain was registered on December 14, 2025, through NiceNIC International Group Co., Limited, and its infrastructure relies on Cloudflare nameservers (marlowe.ns.cloudflare.com and odin.ns.cloudflare.com). It resolves to IP address 172.67.138.108, which is hosted by Cloudflare (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1). The page title is recorded as a Hebrew phrase, only a moment, which is consistent with a redirect or holding page commonly used in phishing operations. HTTP status 403 indicates access is restricted, possibly to evade analysis. Gridinsoft trust score is 0 out of 100, and the domain appears on one security blocklist. VirusTotal shows 7 out of 95 security vendors flagging this domain as malicious, and it is specifically blocked by PhishDestroy. Defenders should treat this domain as actively hostile. The exact phishing payload or brand impersonated has not been confirmed from the available data, but the combination of a low trust score, blocklist presence, and vendor detections supports a high-risk classification. Recommended actions include blocking the domain at network and email gateways, monitoring for any associated IPs or subdomains, and reporting the domain to hosting and registrar contacts for takedown. Given the active status and Cloudflare infrastructure, defenders should also consider that the domain may be using CDN services to mask the origin server, requiring additional investigation to identify the true hosting backend.