franklincoin[.]net

Analysis shows that franklincoin.net is an active domain leveraged for generic phishing, as indicated by its classification and the presence of the page title "Just a moment..." The domain was registered on December 08, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑managed address 104.21.74.61, which is associated with AS13335 in the United States. The site employs Cloudflare services, including HSTS, Cloudflare Browser Insights, and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services under the WE1 root. Security telemetry flags the domain as hostile: it is blocked by PhishDestroy, appears on one public blocklist, and has been referenced in 24 AlienVault OTX pulses. VirusTotal records five detections out of ninety‑five scanned vendors, and Gridinsoft assigns a trust score of zero, reinforcing the high‑risk assessment. The HTTP response returns a 403 status, suggesting restricted access that may be used to evade automated analysis. While the exact phishing payload or targeted brand is not disclosed, the combined infrastructure signals, blocklist entries, and threat‑intel references provide sufficient evidence for defenders to treat the domain as malicious. Recommendations include adding franklincoin.net to network deny lists, monitoring DNS queries for the associated Cloudflare nameservers (clayton.ns.cloudflare.com, lilyana.ns.cloudflare.com), and employing endpoint detection to block any attempted credential capture associated with this domain.