Phishing detection: coinbasee.vip

Coinbase
https://coinbasee.vip Access site
Screenshot
Screenshot of coinbasee.vip
Investigate
Domain coinbasee.vip2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 172.189.184.225
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://coinbasee.vip
urlscan Wayback archive.today
Cert YR1
crt.sh Censys Google CT
Phishunt analysis Beta
26 low suspicionheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +3.2 Young domain
  • +2.2 Country mismatch
  • +1.4 Registrar reputation
  • +1.2 ASN reputation
  • +1.1 No CSP header
  • +1.0 Site cluster
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.7 Brand in cert SAN
  • +0.7 Brand typo
  • +0.6 Suspicious TLD
  • +0.3 Free CA
  • +0.3 Long domain
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonating Coinbase using a typosquatted domain with a doubled-letter suffix, hosted on Microsoft Azure in France. Flagged by Google Safe Browsing for social engineering and carries minimal domain registration status, indicating a freshly staged phishing setup.

Google Safe BrowsingKeyword matchCountry mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-09 · confidence 62%
Domain & Network
Whois
Registrar Gname.com Pte. Ltd.
Network
IP 172.189.184.225
Country FranceFrance
Hosting Microsoft Corporation
ASN AS8075
TLS Cert YR1
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Microsoft Corporation
abuse@microsoft.com Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-09 05:25 UTC  ·  Last refreshed 2026-09-12 21:30 UTC