forge-eth[.]io

Analysis indicates that the domain forge-eth.io is actively engaged in brand impersonation targeting Coinbase, classified as a high-risk crypto scam. The domain was registered on March 11, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 37.1.204.81, hosted on AS58061 (Scalaxy B.V.) in the Netherlands. The infrastructure employs Cloudflare, Nginx, Node.js, and Express, alongside HSTS and Google Analytics, suggesting an attempt to appear legitimate while maintaining operational security. The SSL certificate is issued by Let's Encrypt (R12), and the domain's nameservers are ns61.domaincontrol.com and ns62.domaincontrol.com. The page title, FORGE ETH, aligns with the reported scam type, which involves cryptocurrency fraud. Detection systems, including PhishDestroy, MetaMask, and SEAL, have flagged the domain, and it appears on three security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. MX records point to forgeeth-io01c.mail.protection.outlook.com, indicating potential email-based attack vectors. While the domain remains active as of July 12, 2026, defenders should prioritize blocking resolutions to 37.1.204.81 and monitoring associated email infrastructure. The use of Let's Encrypt and Cloudflare is consistent with threat actors attempting to evade detection, though these measures do not mitigate the domain's malicious intent. No additional details about the exact content or mechanics of the scam are currently available, but the combination of brand impersonation, crypto-themed page title, and detection by multiple security vendors confirms its fraudulent nature. Organizations are advised to treat this domain as a confirmed threat and update filtering rules accordingly.