file[.]firstcoinbase[.]net

The domain file.firstcoinbase.net was created on March 13, 2025 and is registered through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 15.197.130.221, which is hosted in the United States and belongs to ASN16509 owned by Amazon.com, Inc. The domain is served by a set of European registrar nameservers (ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu) and by two additional nameservers (ns2.blazingfast.io, ns1.bla). No TLS certificate is present for the domain, indicating that any web service would have been delivered over plain HTTP. The page title observed in prior captures is "firstcoinbase.net," and the intelligence explicitly links the site to a Coinbase brand impersonation and classifies the operation as a crypto‑scam.

VirusTotal scans have flagged the domain by 11 of 95 security vendors, and the domain appears on a single security blocklist, where it is listed by PhishDestroy. Current operational status is offline, so the live content cannot be verified, but the combination of the page title, brand target, and scam type provides sufficient context to treat the domain as malicious. Defenders should proactively block file.firstcoinbase.net at network perimeters and update endpoint security solutions with the observed indicator set, including the associated IP 15.197.130.221 and the registrar‑level nameservers. Monitoring for any re‑activation of the domain or the emergence of sibling domains using the same registrar or hosting infrastructure is recommended.

Because the domain lacks an SSL certificate, any future re‑hosting that adds TLS would be a notable change and should trigger re‑evaluation. Threat intelligence platforms should ingest the registration date, registrar details, and the detection count from VirusTotal to enrich existing phishing feeds.