DANGEROUS

Crypto scam / wallet-drainer

Flagged on major browser safety blocklists as social engineering. Signals match fake investment platforms and wallet drainers. Never connect a wallet, paste a seed phrase, or deposit crypto here.

Security Review

Is coinbase-airdrop.b12sites.com legit or a scam?

Our verdict:Dangerous· 1/100

Fake Coinbase airdrop site flagged as phishing by ten engines including BitDefender, ESET, and Fortinet.

coinbase-airdrop.b12sites.comScanned 1h ago
0
Trust score
DANGEROUS
Score breakdown
Heuristics 0·MT 15
Category tags
phishingcrypto#phishing#crypto fraud#airdrop drainer#coinbase pay phish90% MT confidence
Technical red flags (2)
10 of 92 engines flaggedBlacklisted by Google
Positive signals (3)
Domain is 9 years oldEncrypted connectionClean server reputation

These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.

View density

Analysis Summary

Threat Intelligence
10/92
Engines flagged this URL
Domain Age
9 years old
Registered Feb 13, 2017
Intelligence
Dangerous
High likelihood · 90% confidence

Website Preview

Screenshot of coinbase-airdrop.b12sites.com
LIVE RENDER
coinbase-airdrop.b12sites.com

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site.

Intelligence

Advanced threat intelligence
Analysis
High scam likelihoodengineMT · Guardiantrust15/100
MT AgentLive web researchVisual inspection
0%
Confidence
The domain name coinbase-airdrop.b12sites.com directly impersonates Coinbase to lure users into a fake airdrop. Ten of 92 antivirus engines flagged the page as phishing, with BitDefender, ESET, Fortinet, and others explicitly detecting the threat. Browser blocklists also flagged it for social engineering, confirming the credential-harvesting intent. The subdomain structure on b12sites.com is a common pattern for disposable scam pages. The hosting IP shows no abuse history, but that does not outweigh the clear malicious signals from multiple detection layers. The combination of brand impersonation, phishing detections, and blocklist hits makes this a high-risk site.
Full dossier
Analysis complete

Page Content

The URL path and subdomain explicitly reference a Coinbase airdrop, a common lure for crypto credential theft. The page attempts to harvest wallet details or seed phrases under the guise of claiming free tokens.

Infrastructure

The site runs on IP 52.22.145.238 with a valid Let's Encrypt certificate that expires in 30 days. Ten antivirus engines flagged the page as malicious, specifically citing phishing by alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, and G-Data. Browser blocklists also blocked it for social engineering activity.

Domain History

The parent domain b12sites.com was registered in February 2017 and is 9.4 years old. The subdomain coinbase-airdrop appears to be a recent addition used for this campaign rather than a long-standing legitimate service.

Web Reputation

No traffic ranking data exists for this subdomain. The hosting IP carries a clean abuse score with zero reports, yet the page-level detections override that signal.

What this means for you

Do not visit the site or enter any wallet information. The page is actively flagged as a phishing attempt targeting Coinbase users.

Risk Factors
4
  • Domain name impersonates Coinbase to promote a fake airdrop.
  • Ten antivirus engines flagged the page as phishing.
  • Browser blocklists blocked the site for social engineering.
  • Subdomain pattern on b12sites.com is typical of disposable scam infrastructure.
Positive Signals
1
  • Parent domain is 9.4 years old with a clean abuse history on the hosting IP.
AI Recommendation
Avoid the site entirely and never enter wallet credentials or approve transactions on pages that claim to offer Coinbase airdrops.
Next-gen fraud intelligence
Evidence-backedCross-checked

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for coinbase-airdrop.b12sites.com, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Web mentions
No scam reports found
No complaints, no negative coverage turned up in our sweep.

We searched scam-report databases, consumer-review sites, and general web sources for coinbase-airdrop.b12sites.com and did not find scam reports, complaints, or impersonation signals. The domain age, registration record and aggregator reviews shown above are consistent with a legitimate site.

Domain Timeline

  1. Feb 13, 2017
    Domain registered

    First appeared in WHOIS records — 9.4 years old today.

  2. Jul 9, 2026
    Latest security review — Flagged as dangerous

    This scan re-ran every check; the current findings are detailed above.

coinbase-airdrop.b12sites.com is an established domain now carrying threat signals. An older domain that starts tripping security checks is a classic pattern for an asset that was sold, repurposed, or compromised — the age alone is not reassurance.

Threat Detection

Antivirus Engines

Detection matrix · live
10 engines flagged this URL

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. Each detection is listed below by engine name — even a single hit is a meaningful signal.

10Malicious0Suspicious49Harmless92Engines
0
of 92
alphaMountain.ai
Malicious· phishing
BitDefender
Malicious· phishing
ESET
Malicious· phishing
Forcepoint ThreatSeeker
Malicious· phishing
Fortinet
Malicious· phishing
G-Data
Malicious· phishing
Google Safebrowsing
Malicious· phishing
Lionic
Malicious· phishing
Phishtank
Malicious· phishing
Sophos
Malicious· phishing

10 antivirus engines flagged this URL. Even a single detection is a meaningful signal — treat this site with extra caution and avoid entering credentials, payment info, or downloading any files.

Security Scans

Blacklist Check
This URL appears on threat lists

Detected threat categories: SOCIAL_ENGINEERING.

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing
ListedCheck ↗
VirusTotal
ListedCheck ↗
AbuseIPDB
Not listedCheck ↗

Scam-Type Likelihood

2 scam-type patterns detected
Scam-Type Likelihood

2 of 14 categories showed signals

We check every URL against 14 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.

Top match: Crypto Fraud
Crypto Fraud
Moderate likelihood
45/100
  • AI analyst tagged this as crypto fraud / wallet-drainer.
  • AI analyst tagged this as an airdrop / drainer.
Phishing
Moderate likelihood
35/100
  • Google Safe Browsing flagged this as social engineering / phishing.
  • AI analyst tagged this as phishing / data-harvesting.

Technical Details

Domain & Encryption

Domain History
Age9 years old
RegistrarAmazon Registrar, Inc.
RegisteredFeb 13, 2017
ExpiresFeb 13, 2028
Owner privacyVisible
Encryption Certificate
StatusValid
ProtocolTLSv1.3
IssuerLet's Encrypt · E8
ExpiresAug 9, 2026 (30d)
Self-signedNo
Hosting & Technology
HostingAmazon Technologies Inc.
Server locationUS

Redirect Chain

Hops
1
Cross-domain
No
Lookalike
No
Punycode
No
  • 1308http://coinbase-airdrop.b12sites.com/
  • 2404https://coinbase-airdrop.b12sites.com/

Server Reputation

Abuse Intelligence
Confidence score0%
Reports on file0
ISPAmazon Technologies Inc.
Usage typeData Center/Web Hosting/Transit

What to do

Crypto scam / wallet-drainer indicators

The page shows patterns common to crypto-investment scams, fake airdrops, and wallet drainers.

  • Do not interact with coinbase-airdrop.b12sites.com

    Do not enter credentials, deposit money, download files, or install browser extensions from this site.

  • Never paste your seed phrase anywhere

    Legitimate wallets, exchanges and support staff will never ask for your 12/24-word recovery phrase. Typing it into any website — even one that looks real — gives attackers full access to your funds.

  • If you already connected a wallet

    Revoke token approvals immediately using revoke.cash or Etherscan's Token Approvals tool. Move remaining funds to a fresh wallet (new seed phrase). Assume the original wallet is compromised.

  • Report the wallet and URL

    File a report at IC3 (FBI Internet Crime Complaint Center) or your country's cybercrime portal. Recovery is unlikely, but reports help law enforcement map the network.

    Open

Safer Alternatives

Trying to handle crypto? Use a safe option instead

Dealing with crypto? Use a regulated, well-established exchange rather than an unknown site — and never connect your wallet or enter a seed phrase on a page you can't verify.

Suggestions for safety only — not endorsements. Always verify the address bar before signing in or paying, even on well-known sites.

Final Verdict

0
Trust / 100
Final Verdict·coinbase-airdrop.b12sites.com
DANGEROUS

This is a fake Coinbase airdrop page designed to steal crypto credentials. Ten security engines flagged it as phishing, and major browser blocklists block it for social engineering.

Avoid the site entirely and never enter wallet credentials or approve transactions on pages that claim to offer Coinbase airdrops.

AV engines
92
Domain age
9 yrs
Flagged
10
Scan another URL
Security review completemalwaretips.com/url-scan

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

  • Our automated security review flags coinbase-airdrop.b12sites.com as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.
  • No — coinbase-airdrop.b12sites.com scored 1/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.
  • Yes. coinbase-airdrop.b12sites.com presents a valid TLSv1.3 certificate issued by Let's Encrypt · E8, expiring in 30 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
  • coinbase-airdrop.b12sites.com is 9.4 years old, registered on 2/13/2017 through Amazon Registrar, Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
  • 10 out of 92 antivirus engines in our malware network flagged coinbase-airdrop.b12sites.com as malicious or suspicious (10 outright malicious). Even one detection is a meaningful signal.
  • Yes. The major browser blocklist feeds flagged coinbase-airdrop.b12sites.com with the following threat categories: SOCIAL_ENGINEERING. This protects billions of browser users from visiting the site.
  • coinbase-airdrop.b12sites.com resolves to an IP operated by Amazon Technologies Inc. in US (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
  • This is a permanent record of the scan run on July 9, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around coinbase-airdrop.b12sites.com have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.
Recently scanned

Other Dangerous reports

Browse all reports
Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…
Loading comments…
This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.