# welcome-coinbase-advance.pages.dev — MALICIOUS

> Discover why welcome-coinbase-advance.pages.dev is a dangerous phishing site impersonating Coinbase. Learn how to protect your data today.

## Summary
PhishDestroy identifies welcome-coinbase-advance.pages.dev as a high-risk phishing domain targeting Coinbase users. This site was flagged for social engineering and listed on multiple security blocklists.

The phishing page mimics Coinbase to trick users into submitting sensitive information. It exploits trust in the brand to harvest credentials or financial data by presenting itself as a legitimate Coinbase access point.

If you visited this site, immediately avoid entering any data and run a security scan on your device. Change any potentially exposed passwords and monitor your accounts for suspicious activity. This domain is currently offline but vigilance remains essential.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.126
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["nolan.ns.cloudflare.com", "lia.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc937-58cc-71fe-bf5d-8679dfe5ff75.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/64117723-ea60-44bd-9141-1544cb9dbf57
- PhishDestroy: https://phishdestroy.io/domain/welcome-coinbase-advance.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/welcome-coinbase-advance.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/welcome-coinbase-advance.pages.dev/
Last updated: 2026-03-19