web3-coinbas-extension[.]typedream[.]app

Analysis of the domain web3-coinbas-extension.typedream.app shows that it is currently offline, returning a 404 HTTP status with the page title "404: This page could not be found." The site was hosted on Cloudflare infrastructure (AS13335) and resolved to IP address 188.114.96.3, a Cloudflare‑owned server located in the United States. TLS termination was provided by Google Trust Services under the WE1 certificate, indicating a valid SSL chain but not confirming legitimacy of the underlying content. Detected technology stacks include Node.js, React, Next.js, Google Cloud services, Cloudflare Browser Insights, and Google Cloud CDN, all of which are common for legitimate web applications but also frequently leveraged by malicious actors to blend into normal traffic.

The registrar listed is Cloudflare, Inc., and no authoritative nameserver information was returned by the query. VirusTotal scans flagged the domain by 13 of 95 security vendors, and the domain appears on a single public blocklist. It has been classified as a crypto‑related scam that impersonates Coinbase, and it is actively blocked by the PhishDestroy feed.

While the offline status limits immediate payload observation, the combination of brand impersonation, a reputable SSL certificate, and the use of widely trusted hosting services suggests an intent to deceive users who may encounter the URL in phishing campaigns or malicious email links. Defenders should continue to block the domain and its resolving IP in network and DNS filters, monitor for any re‑activation or new hostings associated with the same IP range, and incorporate the domain hash into endpoint and email security policies. Additional scrutiny of related subdomains under typedream.app and any future registrations using similar naming patterns is recommended to pre‑empt replication of this impersonation technique.