coinbaseactivate.com - phishunt.io

Coinbase

https://coinbaseactivate.com Access site

Screenshot

Investigate

Domain coinbaseactivate.com2 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

See every phishunt record for this domain

IP 104.168.138.151

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://coinbaseactivate.com

urlscan

Wayback

archive.today

Cert YR2

crt.sh

Censys

Google CT

Phishunt analysis Beta

33 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+6.1 Google Safe Browsing
+5.3 Keyword match
+4.1 Brand in screenshot
+4.0 Young domain
+3.7 Brand in domain label
+1.4 Registrar reputation
+1.1 ASN reputation
+1.1 No CSP header
+1.1 No HSTS header
+1.0 Site cluster
+0.9 Young certificate
+0.9 No registrar lock
+0.7 Brand in cert SAN
+0.7 Unrecognised DNS provider
+0.4 Long domain
+0.3 Free CA
+0.2 Suspicious TLD

20 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Newly registered domain that combines Coinbase with 'activate' to impersonate the exchange. The certificate names the brand and the page screenshot shows Coinbase text. Google Safe Browsing flags it for social engineering, indicating credential harvesting.

Google Safe BrowsingBrand in cert SANYoung domain

AI-generated from stored detector signals - the AI never visited the site. · 2026-11-12 · confidence 85%

Domain & Network

Whois

Registrar NICENIC INTERNATIONAL GROUP CO., LIMITED

Network

IP 104.168.138.151

Country