paiementleboncoin[.]trxf[.]fr

Analysis of the domain paiementleboncoin.trxf.fr indicates an active high-risk phishing campaign targeting users through a credential-harvesting page. The domain was registered on June 4, 2026, via IONOS SE and currently resolves to the IP address 217.160.0.234. Infrastructure analysis reveals the use of four nameservers: ns1030.ui-dns.biz, ns1084.ui-dns.de, ns1111.ui-dns.com, and ns1120.ui-dns.org, which are consistent with hosting providers commonly exploited for phishing operations. The page title, 'Valide – Service enregistrement,' suggests an attempt to mimic a legitimate authentication or verification service, though the exact brand impersonation remains unconfirmed due to the absence of additional brand-specific indicators. As of July 19, 2026, the domain is flagged by 9 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. The detection count, while not exhaustive, corroborates the classification of this domain as malicious. Defenders should prioritize blocking the domain and its resolving IP address (217.160.0.234) at the network level, as well as monitoring for related indicators of compromise, such as user reports of credential theft or unauthorized access attempts. The domain remains active, and further investigation into its hosting infrastructure may reveal additional linked phishing domains or command-and-control channels. No evidence currently links this campaign to a specific phishing kit or threat actor group.