royalcoinshug[.]com

Analysis of royalcoinshug.com shows a recently created (21 Feb 2026) domain that was taken offline but left a forensic trail indicating a high‑risk generic phishing operation. The site was protected by a Let’s Encrypt R13 certificate and served over HTTP/3, employing a front‑end stack that included D3, xCharts, Bootstrap, LiteSpeed, Select2, jQuery and FancyBox. Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded 14 of 93 security vendors marking it as malicious, reinforcing the suspicion of a phishing payload. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on one additional security blocklist besides PhishDestroy, confirming its inclusion in active threat feeds.

Infrastructure analysis reveals the host IP 198.251.81.188 belongs to AS53667 (FranTech Solutions) in the United States, with authoritative nameservers ns17.asurahosting.com and ns18.asurahosting.com, typical of disposable hosting services. The only visible page element is a title reading "1 new message," providing no further insight into the targeted brand or credential‑collection mechanism. Consequently, the precise impersonated entity remains uncertain, and no payload samples have been captured.

Defenders should immediately block the domain and its hosting IP at DNS and firewall layers, ingest the associated hash and indicator data into SIEM and EDR solutions, and monitor for re‑registration or similar patterns from the same ASN or hosting provider. Email gateways should be tuned to flag messages containing the domain or related social‑engineering cues, and threat‑intelligence teams should track the ASN for future malicious registrations. Continuous re‑scanning of the domain, should it reappear, is advised to capture any evolving payloads or new indicators.