urlquery Phishing - Coinbase
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
http://max-coinbase.com/
public
Phishing detected
Review evidence →4 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://max-coinbase.com/
- Submitted IP / ASN
18.229.199.206 AS16509 · AMAZON-02
- Final URL
- https://max-coinbase.com/
- Final IP / ASN
- 18.229.199.206 AS16509 · AMAZON-02
Final page
- Page title
- coinbase
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 486.6 KB (498231 bytes)
Detections
Activity
- HTTP requests
- 140
- Observed hosts
- 7
- Script records
- 202
Estimated HTTP data
- Sent
- ~68.6 KB
- Received
- ~12.81 MB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
1Threat Detection Systems
2Nextron YARA rules Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type
Verdictmalware
Severitymedium
Quad9 DNS Sinkholed
VerdictMalicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| api.optionsmarket.top | N/A | 2025-07-21 | 2026-06-30 | 2026-08-26 | 16.0 KB | 331.6 KB |  188.114.97.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| max-coinbase.com 185 alerts | N/A | 2026-08-24 | 2026-08-26 | 2026-08-26 | 41.6 KB | 11.99 MB | 18.229.199.206 | Ubuntu Operating systems Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT. Nginx:1.24.0 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| jiaoyisuo.thai2570.com | N/A | 2021-08-10 | 2025-03-22 | 2026-08-26 | 3.5 KB | 170.8 KB | 104.21.6.141 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| api.web3modal.org | 433029 | 2022-11-18 | 2023-09-19 | 2026-08-23 | 2.2 KB | 2.2 KB | 104.18.19.237 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| fonts.reown.com | N/A | 2000-01-28 | 2025-09-26 | 2026-08-19 | 3.7 KB | 330.2 KB | 172.66.146.49 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| cca-lite.coinbase.com | 2742073 | 2011-07-02 | 2023-08-12 | 2026-08-21 | 1.1 KB | 2.2 KB | 172.64.152.241 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| pulse.walletconnect.org | 247907 | 2018-03-26 | 2023-10-09 | 2026-08-23 | 601 B | 271 B | 104.20.34.30 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |