app-coinbase-wallet-eng[.]typedream[.]app

The domain app-coinbase-wallet-eng.typedream.app was created on 2026-02-21 and is currently offline, returning an HTTP 404 status. The site presented the page title “Coinbase Wallet – Your key to the world of crypto,” directly referencing the Coinbase brand, which aligns with the intelligence classification of a crypto‑related brand impersonation. SSL is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but offering no assurance of the underlying content. Infrastructure analysis shows the domain resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The hosting stack includes Node.js, React, Next.js, Google Cloud services, and Cloudflare CDN, all common components for legitimate web applications, yet they are also frequently leveraged by malicious actors to host deceptive pages.

Registration was performed through Squarespace Domains II LLC, a registrar often used for rapid domain acquisition. Threat intelligence indicates that six of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site appears on one public blocklist. PhishDestroy has actively blocked the domain, confirming detection by at least one anti‑phishing service. The intelligence tags the activity as a crypto scam, targeting users of Coinbase by exploiting brand trust.

No visual artefacts or login forms have been captured, so the exact malicious payload cannot be confirmed. However, the combination of a brand‑specific title, cryptocurrency‑focused phrasing, and a modest VirusTotal detection rate provides sufficient evidence for classification as a crypto‑related brand impersonation campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration of similar sub‑domains, and consider adding the IP address 188.114.97.3 to threat‑intel feeds.