stakechainwallet[.]web[.]app

The domain stakechainwallet.web.app was observed hosting a crypto‑related page that explicitly references Coinbase, as indicated by the page title "Stakechain Crypto Hardware Wallet (Official) | The best wallet to protect your assets" and the recorded impersonation of the Coinbase brand. Technical analysis shows the domain resolves to the IP address 199.36.158.100, which is owned by Fastly, Inc. (AS54113) and geolocated to the United States. DNS resolution is provided by ns-cloud.googledomains.com, confirming Google’s DNS infrastructure. The site employed a Google Trust Services certificate (WR4) and served content over HSTS and HTTP/3, with Firebase detected as the backend platform.

HTTP probing returned a 404 status, indicating the primary page is no longer accessible; the domain’s current operational state is marked as taken offline. Registration information lists Google LLC as the registrar, and the domain appears on a single security blocklist, where it has been flagged by PhishDestroy. VirusTotal scans identified 15 of 95 security vendors as flagging the domain, reinforcing the malicious classification.

The combined indicators—brand impersonation of Coinbase, use of a trusted SSL certificate to lend legitimacy, and the presence on a reputable blocklist—suggest a targeted crypto‑scam campaign. While the site is offline, defenders should continue to monitor the associated IP (199.36.158.100) for any re‑hosting activity, enforce blocklist entries across perimeter defenses, and update threat intelligence feeds to include this indicator set. Uncertainty remains regarding the exact content that was served before the 404 response, as no page capture is available; analysts should treat any future resolution of the domain as potentially hostile and apply appropriate containment measures.