qoinbase--extnsuion[.]typedream[.]app

The domain qoinbase--extnsuion.typedream.app was registered on February 21, 2026 through Squarespace Domains II LLC and is currently taken offline. Infrastructure analysis shows the site was hosted on Cloudflare (ASN 13335) with the IP address 188.114.96.3 located in the United States. The SSL certificate was issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS handshake despite the malicious intent. The page title retrieved from the site, "Coinbase Chrome Extension® | Your Gateway to Secure Web3 Access," aligns with the declared scam type of brand impersonation, targeting users of the Coinbase platform.

Technical fingerprints reveal a stack comprising Node.js, React, Next.js, Google Cloud services, Google Cloud Trace, Google Cloud CDN, and Cloudflare Browser Insights, all typical of modern web applications but repurposed here to lend credibility. VirusTotal scans reported eight detections out of ninety‑five security vendors, confirming that multiple anti‑malware engines recognize the domain as malicious. The domain is listed on at least one public blocklist and has been explicitly blocked by the PhishDestroy service. An HTTP request returned a 404 status, suggesting the malicious page has been removed or is no longer serving content.

While the exact payload or credential‑harvesting mechanism cannot be confirmed without live content, the combination of brand‑spoofing page title, reputable SSL, and multiple vendor detections indicates a high likelihood of credential‑phishing activity. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the associated IP, and update endpoint protection signatures to include the eight VirusTotal detections. Further investigation of any recent requests to the IP address may reveal additional artifacts or compromised accounts.