Phishing detection: dss-br.coinbase.com.lc

Coinbase
https://dss-br.coinbase.com.lc Access site
Screenshot
Screenshot of dss-br.coinbase.com.lc

Screenshot captured by urlscan.io on 2026-10-27T06:17 UTC: our own render of this page came back blank.

Investigate
Domain dss-br.coinbase.com.lc38 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 34.195.60.139
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://dss-br.coinbase.com.lc
urlscan Wayback archive.today
Cert YE2
crt.sh Censys Google CT
Phishunt analysis Beta
28 low suspicionheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +2.6 ASN reputation
  • +1.7 Shared IP cluster
  • +1.3 Brand typo
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Suspicious TLD
  • +0.5 Long domain
  • +0.3 Free CA
  • +0.3 Deep subdomain
  • +0.1 Hyphens
19 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Coinbase-branded subdomain under a .lc country-code domain that imitates the exchange's name, hosted on AWS. Intended to harvest crypto account credentials. The certificate names the brand and Google Safe Browsing flags it.

Brand in cert SANGoogle Safe BrowsingNo brand links
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-27 · confidence 75%
Domain & Network
Whois
Network
IP 34.195.60.139 AWS EC2
Country United StatesUnited States
Hosting Amazon.com, Inc.
ASN AS14618
TLS Cert YE2
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Amazon.com, Inc.
abuse@amazonaws.com Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-27 17:23 UTC  ·  Last refreshed 2026-10-30 17:30 UTC