qfsbeta[.]com

The domain qfsbeta.com has been identified as a high‑risk brand‑impersonation site targeting users of Coinbase. The page title returned by the server reads “Home - Qfsbeta - A crypto buy and sell marketplace”, indicating an attempt to present a marketplace façade that references the cryptocurrency sector. The site explicitly lists Coinbase as the impersonated brand, confirming its intent to mislead.

Registration data shows the domain was created on 15 March 2025 and is registered through Global Domain Group LLC. Authoritative DNS is provided by ns23.asurahosting.com and ns24.asurahosting.com. The domain resolves to IP 198.251.89.30, which belongs to AS53667 FranTech Solutions located in the United States. The web server runs LiteSpeed and serves content over HTTPS using a Let’s Encrypt R12 certificate. Detected client‑side technologies include Alpine.js, Smartsupp live‑chat integration, and support for HTTP/3.

Reputation analysis indicates the domain is listed on four security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and appears on four additional blocklists overall. VirusTotal scans have flagged the domain by one of ninety‑five security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. The HTTP response code is 200, confirming that the site is actively serving content.

Defenders should treat qfsbeta.com as a malicious infrastructure element and block it at network perimeter, DNS resolvers, and endpoint security solutions. Continuous monitoring of the associated IP address and name servers is advised, as the hosting environment may be leveraged for further fraudulent campaigns. Incident response teams should also update phishing‑detection signatures to include the observed page title and the specific combination of LiteSpeed and Alpine.js fingerprints observed on this host.