qionbase-extnsuon[.]typedream[.]app

Analysis of qionbase-extnsuon.typedream.app shows a domain that was created on 21 February 2026 and is presently taken offline, returning HTTP 403 for all requests. The site is listed on a single security blocklist and is actively blocked by PhishDestroy, indicating that it has been identified as malicious. VirusTotal scans report that nine out of ninety‑three security vendors flag the domain, providing moderate consensus of suspicious activity. The page title returned from the server reads “Coinbase Chrome Extension® – Your Gateway to Web3”, and the brand target is explicitly listed as Coinbase, confirming that the domain is designed to impersonate the cryptocurrency exchange. The underlying infrastructure consists of a Node.js application built with React and Next.js, hosted on Google Cloud services (including Cloud Trace and Cloud CDN) and delivered through Cloudflare’s content delivery network.

The server also utilizes Webpack for asset bundling. SSL termination is performed by Google Trust Services under the WE1 certificate, which is typical for Google‑hosted services. DNS resolution points to IP 188.114.97.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Registration was performed through Squarespace Domains II LLC, a registrar often used for legitimate sites, which does not by itself mitigate the observed malicious indicators. The combination of a brand‑spoofing page title, the explicit target of Coinbase, the crypto‑scam classification, and the presence on a security blocklist creates a high confidence that the domain is being used for fraudulent purposes.

However, the limited number of blocklist entries and the relatively low VirusTotal detection ratio leave some uncertainty about the scale of the operation and whether additional payloads are hosted behind the 403 response.