# coinbase-sign-webs.pages.dev — MALICIOUS

> coinbase-sign-webs.pages.dev is a phishing site mimicking Coinbase. Stay alert and avoid entering your info. Learn how to protect yourself now.

## Summary
PhishDestroy has identified coinbase-sign-webs.pages.dev as a dangerous phishing domain designed to impersonate the well-known cryptocurrency platform Coinbase. This site poses a high risk by attempting to trick users into revealing sensitive account details through fraudulent means.

The phishing operation works by closely mimicking Coinbase’s branding and user interface, luring victims into believing they are on the legitimate site. Visitors are prompted to enter personal credentials or financial information, which attackers then capture for malicious use. This domain was flagged by multiple security vendors and appeared on several blocklists before it was taken offline.

If you have visited coinbase-sign-webs.pages.dev, it is crucial to immediately change your Coinbase account password and enable two-factor authentication. Monitor your accounts for any suspicious activity and avoid clicking links from unknown or unsolicited emails. Staying vigilant helps protect your assets from these increasingly sophisticated scams.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.46.244
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["holly.ns.cloudflare.com", "todd.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "Chong Lua Dao", "CyRadar", "ESET", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cb23f-00cf-744b-9282-14f818977690.png
- PhishDestroy: https://phishdestroy.io/domain/coinbase-sign-webs.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-sign-webs.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-sign-webs.pages.dev/
Last updated: 2026-03-19