access-coinpro-en-us[.]typedream[.]app

The domain access-coinpro-en-us.typedream.app was created on February 21, 2026 and is hosted behind Cloudflare (ASN 13335). DNS resolution points to IP 104.21.37.85, a Cloudflare‑owned address located in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code when accessed. The SSL certificate is issued by Google Trust Services under the WE1 label, indicating a valid TLS handshake but not confirming legitimacy of the content.

Multiple defensive services have flagged the domain: PhishDestroy blocked it, Google Safe Browsing labeled it as a social‑engineering threat, and VirusTotal recorded 17 detections out of 95 scanned vendors. A Gridinsoft trust score of 0 out of 100 further underscores the malicious assessment. The underlying technology stack consists of Node.js, React, Next.js, Google Cloud services (Trace, CDN), Cloudflare, and Webpack, a combination frequently observed in phishing infrastructure that leverages modern web frameworks for rapid deployment. The registrar information shows registration through Squarespace Domains II LLC, a common registrar for disposable or short‑lived domains.

The domain currently appears offline, but the historical evidence suggests it was used for a generic phishing campaign. Defenders should add the domain and its associated IP address to blocklists, continue monitoring for any re‑registration or reuse of the same hosting resources, and ensure endpoint protection reflects the 17 VirusTotal detections. Continuous observation of Cloudflare‑assigned IP ranges for similar activity is advisable, as threat actors often recycle these addresses for new campaigns.