coin-web-coinbase-pro[.]typedream[.]app

The domain coin-web-coinbase-pro.typedream.app is a high-risk brand impersonation threat, currently active and targeting users of Coinbase. The domain impersonates Coinbase's official platform, specifically mimicking the advanced trading page with the title 'Coinbase Pro → Advanced Trade'.

This domain is flagged by 2 of 95 VirusTotal vendors, indicating a potential threat level despite not being widely recognized by security services. It resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services, which might lend a false sense of security to unsuspecting users. The domain's creation date and registrar information are not provided, but infrastructure analysis reveals a low trust score and a minimal presence on blocklists, suggesting a recent or rapidly evolving threat. The low detection rate by security vendors does not diminish the risk, as brand impersonation can be highly effective even when not widely recognized.

The domain remains active and poses a significant risk to users who may be tricked into providing sensitive information such as login credentials. Security analysts recommend that users verify the domain's legitimacy by comparing it with the official Coinbase website and using multi-factor authentication (MFA) for added security. Organizations should block this domain and educate employees on the signs of brand impersonation to prevent potential compromise. Furthermore, monitoring for similar domain names and IP addresses is advised to stay ahead of potential threat actors using similar tactics.