eng-coinbasepro-us[.]typedream[.]app

This domain, eng-coinbasepro-us.typedream.app, is identified as a brand impersonation phishing site targeting Coinbase users. Analysis confirms the domain hosts fraudulent login pages designed to harvest credentials by mimicking the official Coinbase sign-in interface. The current status of the domain is offline, though prior activity remains a verified threat. Infrastructure analysis reveals the domain was registered on January 22, 2021, through Squarespace Domains II LLC. It resolves to IP address 104.21.37.85, hosted on Cloudflare infrastructure (AS13335). The domain is flagged by 21 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing classifies it as a phishing site, and the SSL certificate is issued by Google Trust Services (WE1). The page title, 'Coinbase - Sign In,' further confirms the intent to deceive users into entering sensitive account details. The domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain at the DNS level and monitor for credential reuse. Users who accessed the site should immediately reset Coinbase passwords and enable multi-factor authentication. Security teams should review logs for connections to 104.21.37.85 and the domain name to identify potential compromise.