wallet-coinbase-com[.]typedream[.]app

This domain, wallet-coinbase-com.typedream.app, is identified as a brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. The domain was designed to deceive users into believing they are interacting with a legitimate Coinbase wallet service, thereby facilitating credential harvesting and unauthorized access to cryptocurrency assets. As of the latest assessment, the domain has been taken offline, though its prior activity remains a significant concern for cybersecurity professionals. Analysis indicates that the domain was registered on February 21, 2026, through Squarespace Domains II LLC. It resolves to the IP address 104.21.37.85, hosted on infrastructure associated with AS13335 Cloudflare, Inc. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services under the identifier WE1, which may lend an air of legitimacy to unsuspecting users. Notably, the page title returned a 404 error, suggesting either a takedown or a temporary suspension of malicious activity. The current status of the domain is offline, reducing immediate risk to end users. However, the infrastructure and registration details remain relevant for ongoing monitoring. Organizations and individuals are advised to block access to this domain at the network level and include its indicators of compromise in threat intelligence feeds. Users who may have interacted with this domain should immediately reset their credentials, enable multi-factor authentication, and monitor their accounts for unauthorized transactions. Security teams should review logs for connections to 104.21.37.85 and investigate any related phishing attempts targeting cryptocurrency platforms.