chrome-coinbase-extension[.]typedream[.]app

The domain chrome-coinbase-extension.typedream.app was observed hosting a page titled "🔐 Coinbase® Wallet Chrome Extension: A Comprehensive Web3 Portal 🚀" and is explicitly targeting the Coinbase brand. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which is associated with AS13335 owned by Cloudflare, Inc., and geolocated to the United States. The site employed a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating encryption was provided via Google’s public‑key infrastructure. Technical fingerprints reveal a stack comprising Node.js, React, Next.js, Google Cloud services (including Cloud Trace and Cloud CDN), Cloudflare, and Webpack, all of which are typical of modern web applications but also commonly abused by malicious actors.

Registration metadata indicates the domain was created through the Typedream platform, consistent with the “typedream.app” suffix. VirusTotal scans reported that ten of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. The domain has been listed on at least one external blocklist and is actively blocked by PhishDestroy, which further evidences its classification as a phishing or crypto‑related scam. An HTTP request returned a 404 status, and the site is presently offline, suggesting the operators have taken the site down, possibly in response to detection or takedown actions.

While the exact phishing page content could not be recovered, the combination of brand impersonation, a crypto‑focused title, and the detection history indicates a cryptocurrency‑related credential‑harvesting campaign. Defenders should add the domain and its resolving IP to proxy and firewall deny lists, monitor for any resurgence of the same infrastructure, and advise end users, especially Coinbase customers, to disregard any unsolicited prompts referencing this extension.