coinbase-chromeextension[.]typedream[.]app

The domain coinbase-chromeextension.typedream.app was registered on February 21 2026 through Squarespace Domains II LLC and is currently taken offline. It resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented an HTTP 404 response with the page title “404: This page could not be found.” The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid certificate chain but not confirming legitimacy. Automated scanning on VirusTotal recorded 16 positive detections out of 95 participating security vendors, and the domain appears on a single external blocklist, specifically PhishDestroy.

Technology fingerprinting identified a stack comprising Node.js, React, Next.js, Google Cloud services (Trace, CDN) and Cloudflare edge services, which is consistent with a generic web‑hosting configuration rather than a dedicated malicious kit. The intelligence tags the activity as a crypto‑related scam that impersonates the Coinbase brand. Although the content is no longer reachable, the presence of multiple vendor detections, blocklist inclusion, and the brand‑impersonation tag suggest the domain was used for credential‑harvesting or malicious redirects targeting cryptocurrency users.

Defenders should add the domain and its resolving IP address to network‑level deny lists, monitor for related sub‑domains under the typedream.app zone, and ensure endpoint protection solutions are updated to reflect the 16 VirusTotal detections. Continuous observation of Cloudflare‑hosted infrastructure linked to AS13335 is advisable, as the provider often hosts both legitimate and abusive traffic. Because the site is offline, further forensic collection may be limited, but historical logs from DNS resolvers and proxy devices can help confirm whether internal users attempted to access the domain before takedown.