Phishing detection: apac2-o25.coinbase.com.lc

Coinbase
https://apac2-o25.coinbase.com.lc Access site
Screenshot
Screenshot of apac2-o25.coinbase.com.lc

Screenshot captured by urlscan.io on 2026-11-09T22:01 UTC: our own render of this page came back blank.

Investigate
Domain apac2-o25.coinbase.com.lc38 CT hosts on apex
URL https://apac2-o25.coinbase.com.lc
Phishunt analysis Beta
33 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +4.1 Brand in screenshot
  • +4.1 Site cluster
  • +3.4 Shared IP cluster
  • +2.6 ASN reputation
  • +1.3 Brand typo
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Suspicious TLD
  • +0.5 Long domain
  • +0.3 Free CA
  • +0.3 Deep subdomain
  • +0.1 Hyphens
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Coinbase using a subdomain of a lookalike .lc domain whose certificate lists the brand name. Likely harvests crypto account credentials. Hosted on Amazon infrastructure, shares an IP with other flagged sites, and is flagged by Google Safe Browsing for social engineering.

Brand in cert SANGoogle Safe BrowsingShared IP cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-11-09 · confidence 80%
Domain & Network
Whois
Network
IP 34.195.60.139 AWS EC2
Country United StatesUnited States
ASN AS14618
TLS Cert YE2
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Amazon.com, Inc.
Brand owner Coinbase

Tracked from 2026-11-09 05:20 UTC  ·  Last refreshed 2026-11-12 11:30 UTC