qa[.]mysafetrader[.]us

This domain, qa.mysafetrader.us, is currently active and hosts a site titled “Safe Trader – Automated Cryptocurrency Trading”. The page is hosted on a DigitalOcean server (AS14061) located in the United States and resolves to 138.197.98.80. Registration data shows the domain was created on 26 September 2025 through NameCheap, Inc., using the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. The site employs Nginx as the web server and includes front‑end libraries such as Bootstrap, jQuery, Popper, Chart.js, and resources from jsDelivr. An SSL certificate issued by Let’s Encrypt (E8) is present, providing HTTPS encryption. The content explicitly impersonates the cryptocurrency exchange brand Coinbase, as indicated by the “brand_impersonation” classification and the declared “Impersonates: coinbase”. The site is listed as a crypto‑related scam in the intelligence feed and has been blocked by the PhishDestroy blocklist. VirusTotal analysis shows a single vendor detection among 93 scanners, and the domain appears on one additional security blocklist. The Gridinsoft trust score is 0/100, reflecting a high risk assessment. Infrastructure analysis reveals no additional infrastructure beyond the single IP address, and no further sub‑domains have been reported. The lack of publicly available malware samples or detailed page content limits the ability to assess the exact credential‑harvesting mechanisms, but the combination of brand impersonation, cryptocurrency trading language, and low trust score indicates a high‑confidence malicious operation. Defenders should add the domain to outbound and inbound blocklists, monitor DNS queries for the resolved IP, and enforce strict email filtering for messages referencing “Safe Trader” or similar phrasing. Users should be warned that any unsolicited communication directing them to qa.mysafetrader.us is likely fraudulent, and legitimate Coinbase interactions never occur on this domain.