extenson-coinbases[.]typedream[.]app

Analysis of the domain extenson-coinbases.typedream.app indicates a brand‑impersonation campaign targeting Coinbase users. The site’s only publicly observable artifact is the HTML title “Coinbase® Extension: Your Guide Unlock Web3 Seamlessly”, which directly references the Coinbase brand and suggests a legitimate browser extension. The domain is hosted on Google Cloud infrastructure and served through Cloudflare, utilizing Node.js, React, Next.js and Cloudflare Browser Insights. DNS resolution points to IP 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. TLS termination is provided by a Google Trust Services certificate issued to “WE1”, confirming a valid HTTPS connection but offering no assurance of the site’s legitimacy.

The page returns HTTP 404, indicating the expected content is missing or deliberately hidden. VirusTotal analysis shows ten of ninety‑five scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming that at least one anti‑phishing service has identified it as a threat. Registration was performed through the Typedream platform, a website‑builder service that often allows rapid deployment of short‑lived domains. Taken together, the evidence points to an investment‑scam impersonation that leverages the Coinbase name to lure victims into a fraudulent Web3 extension offering.

The lack of a reachable landing page, combined with the limited blocklist presence, suggests the site may have been transient or taken down after detection, as indicated by its current offline status. However, the underlying infrastructure—public cloud hosting and a reputable TLS certificate—remains reusable for future campaigns. Defenders should continue to monitor the IP address 188.114.97.3 and the associated Cloudflare ASN for other domains exhibiting similar brand‑impersonation patterns.