sso-coinbase-coms-cdn-t-auth[.]typedream[.]app

The domain sso-coinbase-coms-cdn-t-auth.typedream.app is actively engaged in brand impersonation, specifically targeting Coinbase Pro login credentials. This domain is currently classified as an elevated-risk threat with confirmed malicious activity. Analysis indicates the domain is designed to deceive users into believing they are accessing legitimate Coinbase Pro authentication portals, potentially leading to unauthorized account access or financial theft. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.). Security vendor detections show 17 of 95 VirusTotal engines flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate in origin, is frequently exploited in impersonation attacks. The page title, 'Log In | Coinbase Pro® | Digital Asset Exchange*,' precisely matches the legitimate Coinbase Pro branding, increasing the likelihood of successful deception. Current status indicates the domain remains active and unresolved. Organizations are advised to immediately block the domain and its resolving IP (188.114.96.3) at the perimeter firewall and DNS filtering layers. Endpoint protection systems should be updated to include this domain in denylists. Security teams should monitor for any internal connections to this domain or associated IP, as such activity may indicate compromised credentials or ongoing phishing attempts. Users who may have interacted with this domain should be instructed to reset their credentials via verified Coinbase channels and enable multi-factor authentication if not already active.