coinbase-activity.com Open in urlscan Pro
2606:4700:3032::681c:8e1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://coinbase-activity.com/
Effective URL:
https://coinbase-activity.com/signin
Submission: On July 13 via automatic, source certstream-suspicious (July 13th 2020, 2:39:21 pm UTC)

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3032::681c:8e1, located in United States and belongs to CLOUDFLARENET, US. The main domain is coinbase-activity.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 13th 2020. Valid for: a year.

This is the only time coinbase-activity.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 9	2606:4700:303... 2606:4700:3032::681c:8e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6810:85e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	3

9 2606:4700:3032::681c:8e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

coinbase-activity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	coinbase-activity.com 1 redirects coinbase-activity.com	177 KB
1	cloudflare.com cdnjs.cloudflare.com	19 KB
1	jquery.com code.jquery.com	31 KB
10	3

	Domain	Requested by
9	coinbase-activity.com	1 redirects coinbase-activity.com cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	coinbase-activity.com
1	code.jquery.com	coinbase-activity.com
10	3

This site contains links to these domains. Also see Links.

Domain
status.coinbase.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-13` - `2021-07-13`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
cloudflare.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://coinbase-activity.com/signin
Frame ID: 94817F85BE8D98F1CAC557FAF1724180
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://coinbase-activity.com/ HTTP 302
https://coinbase-activity.com/signin Page URL

Detected technologies

Node.js (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /socket\.io.*\.js/i

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /socket\.io.*\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

226 kB
Transfer

809 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://status.coinbase.com/
Title: Status

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://coinbase-activity.com/ HTTP 302
https://coinbase-activity.com/signin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request signin Show response
coinbase-activity.com/
Redirect Chain

https://coinbase-activity.com/
https://coinbase-activity.com/signin

13 KB
3 KB

85ms
84ms

Document
text/html

2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ba829f4bdd31c12f56323a18c72ea61f6431a4d8a9ecd6f334963da76c723d2a

Request headers

:method: GET
:authority: coinbase-activity.com
:scheme: https
:path: /signin
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d4787aec6647eaa5cea0441af906ae0cb1594651145
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 13 Jul 2020 14:39:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: Express
cache-control: public, max-age=0
last-modified: Mon, 13 Jul 2020 14:07:18 GMT
cf-cache-status: DYNAMIC
cf-request-id: 03ea368c29000096d4dd3fe200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5b23c059d8bb96d4-FRA
content-encoding: br

Redirect headers

status: 302
date: Mon, 13 Jul 2020 14:39:05 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d4787aec6647eaa5cea0441af906ae0cb1594651145; expires=Wed, 12-Aug-20 14:39:05 GMT; path=/; domain=.coinbase-activity.com; HttpOnly; SameSite=Lax; Secure
x-powered-by: Express
location: /signin
vary: Accept
cf-cache-status: DYNAMIC
cf-request-id: 03ea368beb000096d4dd3fa200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5b23c059787096d4-FRA

GET
H2 200 app.css
coinbase-activity.com/files/ 177 B
266 B 64ms
62ms Stylesheet
text/css 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/files/app.css?v=2
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 8b81328b4cdc67ff71d7a0eb205becfe6964d93920e05bb9058ebdf28b87cb55

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
etag: W/"b1-1734880725a"
cf-cache-status: MISS
last-modified: Mon, 13 Jul 2020 14:07:24 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
cf-ray: 5b23c05a692e96d4-FRA
cf-request-id: 03ea368c85000096d4dd004200000001

GET
H2 200 core.css
coinbase-activity.com/files/ 325 KB
55 KB 112ms
110ms Stylesheet
text/css 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/files/core.css
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ce0ed0d89357057f8cacc06dabd1289714c5630d02f906fa20b0b9f065ab971d

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
etag: W/"51597-17348808822"
cf-cache-status: EXPIRED
last-modified: Mon, 13 Jul 2020 14:07:29 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
cf-ray: 5b23c05a792f96d4-FRA
cf-request-id: 03ea368c86000096d4dd005200000001

GET
H2 200 main.css
coinbase-activity.com/files/ 238 KB
41 KB 152ms
151ms Stylesheet
text/css 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/files/main.css
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4d585710fb3d1e364a5e854016b82b92f5d741d590a8bd36d2d9469551b9ffea

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
etag: W/"3b685-1734880a7d7"
cf-cache-status: EXPIRED
last-modified: Mon, 13 Jul 2020 14:07:37 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
cf-ray: 5b23c05a793096d4-FRA
cf-request-id: 03ea368c86000096d4dd006200000001

GET
H/1.1 200
OK jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
31 KB 32ms
8ms Script
application/javascript 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 13 Jul 2020 14:39:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 May 2020 23:02:39 GMT
Server: nginx
ETag: W/"5eb09f0f-15d84"
Vary: Accept-Encoding
X-HW: 1594651145.dop215.fr8.t,1594651145.cds205.fr8.shn,1594651145.dop215.fr8.t,1594651145.cds142.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30879

GET
H2 200 socket.io.js Show response
cdnjs.cloudflare.com/ajax/libs/socket.io/2.3.0/ 67 KB
19 KB 25ms
24ms Script
application/javascript 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/socket.io/2.3.0/socket.io.js

Requested by

Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d09ab65ee323e742b2d363ed6063295f34c06e19f9d3fc72ac0865fef57baaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 25482302
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 03ea368c8500006371bda70200000001
served-in-seconds: 0.003
timing-allow-origin: *
last-modified: Fri, 20 Sep 2019 11:01:03 GMT
server: cloudflare
etag: W/"5d84b16f-10c4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5b23c05a6f6a6371-FRA
expires: Sat, 03 Jul 2021 14:39:05 GMT

GET
H2 200 app.js Show response
coinbase-activity.com/files/ 3 KB
1008 B 76ms
75ms Script
application/javascript 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/files/app.js?v=6
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6f2b92b3bae5387040b28cde47dce7244cbf989278c0c3e74b3bcb59bbf00999

Request headers

Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
etag: W/"b56-1734880713e"
cf-cache-status: MISS
last-modified: Mon, 13 Jul 2020 14:07:23 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=14400
cf-ray: 5b23c05a793296d4-FRA
cf-request-id: 03ea368c86000096d4dd007200000001

GET
H2 200 woff.woff
coinbase-activity.com/files/ 76 KB
76 KB 77ms
77ms Font
font/woff 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/files/woff.woff
Requested by: Host: coinbase-activity.com
URL: https://coinbase-activity.com/signin
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4596ad5cd685e4b98edcee180acb15a11a3579ff20449075dca337696a68a9bb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://coinbase-activity.com/files/app.css?v=2
Origin: https://coinbase-activity.com

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
etag: W/"12fb6-1734880ac7f"
cf-cache-status: EXPIRED
last-modified: Mon, 13 Jul 2020 14:07:39 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5b23c05baa8196d4-FRA
content-length: 77750
cf-request-id: 03ea368d45000096d4dd00c200000001

GET
H2 200 / Show response
coinbase-activity.com/socket.io/ 103 B
246 B 43ms
43ms XHR
text/plain 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/socket.io/?EIO=3&transport=polling&t=ND8dNLy
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/socket.io/2.3.0/socket.io.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8438f12fe467da458c8af76e27c3b9dd8c65e89cde4c93775077ed6708c5f8a

Request headers

Accept: */*
Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cf-ray: 5b23c05bfac796d4-FRA
cf-request-id: 03ea368d7c000096d4dd00d200000001

GET
H2 200 / Show response
coinbase-activity.com/socket.io/ 3 B
84 B 225ms
225ms XHR
text/plain 2606:4700:3032::681c:8e1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-activity.com/socket.io/?EIO=3&transport=polling&t=ND8dNMj&sid=v8sFf1h6bUf_lsjyAAAC
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/socket.io/2.3.0/socket.io.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681c:8e1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62325dfc1fc675255519674da6e2c4aad5f51cc6c3217ed3c6fbf6cabe0d86b0

Request headers

Accept: */*
Referer: https://coinbase-activity.com/signin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 13 Jul 2020 14:39:05 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cf-ray: 5b23c05c4b0596d4-FRA
content-length: 3
cf-request-id: 03ea368dac000096d4dd011200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| io object| socket

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.coinbase-activity.com/	1970-01-19 11:40:43	Name: __cfduid Value: d4787aec6647eaa5cea0441af906ae0cb1594651145

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://coinbase-activity.com/files/app.js?v=6(Line 9) Message: connected to ws!

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
coinbase-activity.com
2001:4de0:ac19::1:b:2b
2606:4700:3032::681c:8e1
2606:4700::6810:85e5
4596ad5cd685e4b98edcee180acb15a11a3579ff20449075dca337696a68a9bb
4d585710fb3d1e364a5e854016b82b92f5d741d590a8bd36d2d9469551b9ffea
62325dfc1fc675255519674da6e2c4aad5f51cc6c3217ed3c6fbf6cabe0d86b0
6d09ab65ee323e742b2d363ed6063295f34c06e19f9d3fc72ac0865fef57baaa
6f2b92b3bae5387040b28cde47dce7244cbf989278c0c3e74b3bcb59bbf00999
8b81328b4cdc67ff71d7a0eb205becfe6964d93920e05bb9058ebdf28b87cb55
a8438f12fe467da458c8af76e27c3b9dd8c65e89cde4c93775077ed6708c5f8a
ba829f4bdd31c12f56323a18c72ea61f6431a4d8a9ecd6f334963da76c723d2a
ce0ed0d89357057f8cacc06dabd1289714c5630d02f906fa20b0b9f065ab971d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

coinbase-activity.com Open in urlscan Pro 2606:4700:3032::681c:8e1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

226 kBTransfer

809 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

coinbase-activity.com Open in urlscan Pro
2606:4700:3032::681c:8e1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

226 kB
Transfer

809 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!