restless-grass-33ac[.]support-coinbase[.]workers[.]dev

The domain restless-grass-33ac.support-coinbase.workers.dev is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It poses a cryptocurrency scam threat by mimicking the legitimate Coinbase platform to deceive victims into disclosing login credentials or transferring digital assets. No drainer kit was detected, and the site is currently taken offline.

Technical analysis shows restless-grass-33ac.support-coinbase.workers.dev was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.67.154.110, hosted by Cloudflare in the US. As of the latest scan, 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing has not issued any warnings. However, it appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. The site returned an HTTP 403 status and employed technologies such as HSTS, Cloudflare, and HTTP/3.

Victims of restless-grass-33ac.support-coinbase.workers.dev should immediately change any compromised passwords, enable two-factor authentication on all accounts, and monitor for unauthorized transactions. If cryptocurrency was involved, revoke any token approvals granted to suspicious contracts and consider transferring funds to a new wallet. Report the phishing domain to Coinbase’s security team, as well as to platforms like PhishTank or Google Safe Browsing to aid in broader mitigation efforts.