qa[.]safetrader[.]us

The domain qa.safetrader.us was registered on September 26, 2025 through NameCheap, Inc. and resolves to the IP address 138.197.98.80, which belongs to DigitalOcean, LLC (ASN14061) in the United States. The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8), indicating that HTTPS traffic is encrypted but offering no assurance of legitimacy. Infrastructure analysis shows the web server is powered by Nginx and the front‑end relies on Chart.js, Bootstrap, jQuery, Popper and assets delivered via jsDelivr, a typical stack for fraudulent cryptocurrency pages. The page title "Safe Trader - Automated Cryptocurrency Trading" is consistent with the declared scam type of a crypto‑related scheme and the domain explicitly impersonates Coinbase, a well‑known cryptocurrency exchange.

Security assessments reveal a Gridinsoft trust score of 0 / 100, and the domain appears on at least one public security blocklist. It has been flagged by PhishDestroy and is listed on a single security blocklist, indicating that threat‑intelligence feeds have identified it as malicious. VirusTotal analysis shows a single positive detection out of 93 scanning engines, reinforcing the suspicion. No additional detection services are cited, and the evidence base is limited to the listed vendors and blocklists.

Given the combination of a brand‑impersonation claim, a low trust rating, confirmed blocklist entries, and the presence of a single VirusTotal detection, the site should be treated as an active high‑risk phishing or crypto‑scam operation. Defenders are advised to block the domain at the network perimeter, update DNS filtering policies, and monitor the associated IP address for any further malicious activity. Continuous verification of the domain’s status on blocklists and periodic rescanning with multi‑engine services are recommended to capture any changes in its threat profile.