coinbase-chromextension[.]typedream[.]app

This domain, coinbase-chromextension.typedream.app, is currently offline and returns HTTP 404 with the page title “404: This page could not be found.” The site was hosted on Cloudflare’s network (AS13335) and resolved to IP address 188.114.97.3, which is geolocated to the United States. Infrastructure fingerprints show a stack consisting of Node.js, React, Next.js, Webpack and Google Cloud services such as Cloud CDN and Cloud Trace, all fronted by Cloudflare. The TLS certificate was issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint at the time of capture.

Registration data lists Cloudflare, Inc. as the registrar, and the domain appears on a single security blocklist. VirusTotal recorded 11 detections out of 95 scanned engines, and Google Safe Browsing flagged the URL for social‑engineering content, consistent with a crypto‑scam profile targeting the Coinbase brand. PhishDestroy also reported the domain as blocked.

Because the site is no longer reachable, active payload analysis could not be performed, leaving the exact phishing page layout and credential‑capture mechanisms undocumented. Defenders should continue to block the domain at network perimeter, monitor for any re‑registration attempts, and add the IP address 188.114.97.3 to threat‑intel feeds. Additional scrutiny of any newly observed subdomains under typedream.app that reference Coinbase or crypto terminology is recommended, as the same infrastructure could be reused in future campaigns.