coinbasewalletcom[.]typedream[.]app

The domain coinbasewalletcom.typedream.app was identified as a high‑risk brand‑impersonation site targeting Coinbase users. Technical analysis shows the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.67.206.36, which belongs to the Cloudflare network (AS13335) located in the United States. An SSL certificate issued by Google Trust Services (WE1) is present, indicating HTTPS support, but the site returns an HTTP 404 status with the page title "404: This page could not be found," confirming that the content is currently unavailable. Google Safe Browsing flags the domain for social engineering, and VirusTotal recorded 11 detections out of 95 scanned security vendors, reinforcing the malicious classification.

The domain appears on one public blocklist and is actively blocked by PhishDestroy, further evidencing its use in phishing campaigns. Infrastructure fingerprints reveal a stack of Node.js, React, Next.js, Google Cloud services (including Cloud Trace and CDN), and Webpack, all delivered behind Cloudflare’s edge. The listed nameservers could not be retrieved, which is consistent with Cloudflare’s proxy configuration.

While the site is presently offline, the combination of brand impersonation, crypto‑scam labeling, and the observed technical footprint suggests it was intended to harvest Coinbase credentials or lure victims into cryptocurrency fraud. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts, and update endpoint and web‑filter policies with the observed indicators, including the IP address, SSL certificate thumbprint, and the 404 page title. Additional investigative focus should be placed on any related subdomains or future registrations that reuse the same Cloudflare account or certificate, as attackers often recycle infrastructure for new campaigns.