Phishing detection: api-coinbase.com

Coinbase
https://api-coinbase.com Access site
Screenshot
Screenshot of api-coinbase.com
Investigate
Domain api-coinbase.com1 CT host on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 188.114.97.3
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://api-coinbase.com
urlscan Wayback archive.today
Cert WE1
crt.sh Censys Google CT
Phishunt analysis Beta
31 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +3.4 Shared IP cluster
  • +2.0 ASN reputation
  • +2.0 Young domain
  • +1.4 Registrar reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.7 Brand in cert SAN
  • +0.7 Brand typo
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
21 signals fired · detector v3.0.0
AI analysis AIBeta
Crypto scam

Impersonates Coinbase using an api-prefixed lookalike domain, likely to steal crypto account credentials or wallet access. Certificate names the brand, Google Safe Browsing flags it, and it sits behind Cloudflare with a registrar associated with abuse.

Brand in cert SANGoogle Safe BrowsingRegistrar reputation
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-25 · confidence 75%
Domain & Network
Whois
Registrar NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
IP 188.114.97.3 Cloudflare CDN
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert WE1
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-25 17:23 UTC  ·  Last refreshed 2026-10-25 23:30 UTC