fr-coinbase-secure[.]com

The domain fr-coinbase-secure.com was registered through Name SRS AB on 29 August 2025. It resolves to the IPv4 address 144.172.93.210, which is mapped to the United States and belongs to autonomous system AS14956 operated by RouterHosting LLC. The site presented the HTML title 'Just a moment…', and its SSL certificate is identified as type E8. Reputation services show a Gridinsoft trust score of zero out of one hundred, indicating no confidence in the host. VirusTotal reports that 14 of 93 scanning engines flagged the domain as malicious, and the domain appears on a single public blocklist as well as one AlienVault OTX pulse. PhishDestroy has also listed the domain as blocked.

The observed activity is classified as a crypto‑related scam targeting Coinbase users. As of the report date the domain is taken offline, limiting immediate probing, but the infrastructure remains observable via DNS and IP records. Analysis indicates that the registrar, Name SRS AB, is frequently used by threat actors, and the hosting provider RouterHosting LLC has been associated with other brand‑impersonation campaigns. The low trust score, combined with multiple vendor detections and blocklist listings, suggests a high likelihood that the domain was employed to harvest credentials or lure victims into fraudulent cryptocurrency transactions.

The exact page content beyond the title has not been captured, so the specific phishing mechanics remain unknown. Defenders should add the IP address 144.172.93.210 and the domain fr-coinbase-secure.com to network and endpoint deny lists, monitor for DNS queries to the domain, and enforce TLS inspection to detect any future reuse of the certificate. Correlation with other domains hosted on the same AS may reveal additional malicious sites. Continuous monitoring of threat‑intel feeds for new detections related to this registrar and hosting provider is recommended.