Security Scan Report: 1789503-coinbase.com

Redirected to:
https://galootapprehension.xyz/?k=97e40597363fd477d114265e440dc75b.179...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 1 IP in 1 country across 2 domains to perform 3 HTTP transactions. The main domain is 1789503-coinbase.com and was registered 1 year ago.

Submitted URL: https://1789503-coinbase.com

Effective URL:
https://galootapprehension.xyz/?k=97e40597363fd477d114265e440dc75b.179...
Redirected

AI Security Verdict

Moderate Risk

Confidence: 62%

5
Risk Score

Entry domain 1789503-coinbase.com squats the Coinbase name and redirects to a random .xyz page serving only a generic 'no promotions' placeholder. No forms or malware found, but the deceptive brand hostname makes it untrustworthy.

Risk Factors (4)
Deceptive hostname on the entry domain that incorporates a well-known financial brand (Coinbase) without affiliation
Cross-domain redirect from a brand-squatting domain to an unrelated random .xyz landing page
Base64-obfuscated tracking parameter carrying the entry hostname, typical of affiliate/malvertising funnels
Final landing domain is unknown-age and unranked with no identifiable legitimate business identity
Safety Factors (4)
No credential, password or payment form present (0 forms, 0 password fields, 0 payment fields)
No JavaScript malware or YARA matches; all scripts served from the site's own domain
No Indicators of Compromise matches and no cross-origin credential exfiltration detected
No Google Safe Browsing or malware IDS alerts
Domain age information unavailable

Details

Page Title

No Offers Available...

Scan Type

public

Domain Name Analysis

Domain '1789503-coinbase.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion '1789503-coinbase' spans 16 characters split between 4 vowels and 4 consonants, along with seven digits and 1 hyphen. Breaking it apart gives 3 words: 1789503, coin, base. Expect four characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://1789503-coinbase.com

Page Load Overview

1.51s
Total Load Time
3 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:68%
Script:Latin
Direction:ltr

Detection Details

Text Length:13 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
334.196.13.28Aws · CLOUDAshburn, Virginia, United States
AS14618Amazon.com, Inc.
31--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T109E0A3C3C016101D63464604F46177092EAE8E6923D64E713A4D9A6FFCCFD36D6041DC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6:qzxUSS+ioffAbplMIT1ZIzZQKpApAEB96DHGjlImpOquUFMfHh+7AIzF32FrYyqn:kx4+HgQfASDHG3pOLUFoHQ0Izl5yJ9a

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:1c69c8b50b0f554d485582dfbd939d70

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:e7e7ffffffffffff
Perceptual Hash:e666666626999999
Difference Hash:0c0c000000000000
Wavelet Hash:27273f3f00000000
Color Hash:#4dbf40

Other Hashes

Crop Resistant:0c0c000000000000

Scan History

Scan history not available

Unable to load historical scan data