sso-coinbase-com-cdnn-x-auth[.]typedream[.]app

Analysis of sso-coinbase-com-cdnn-x-auth.typedream.app indicates a brand impersonation phishing campaign targeting Coinbase users. The infrastructure is designed to mimic authentication entry points, presenting a login interface titled "Log In | Coinbase Pro® | Digital Asset Exchange*" to solicit user credentials and potentially enable account takeover.

Telemetry shows multiple corroborating security signals. VirusTotal reports 18/95 security vendors flagging the domain. The registrar is Cloudflare, Inc., and the resolved infrastructure maps to IP 104.21.37.85 hosted under AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1. The domain appeared on 1 security blocklist and is explicitly blocked by PhishDestroy. Google Safe Browsing classifies the domain as phishing.

At the time of analysis, the domain status is offline, indicating successful disruption of active delivery. However, historical indicators confirm prior malicious intent and established impersonation infrastructure. Users who interacted with the domain should assume credential compromise risk, especially for accounts matching the impersonated brand. Recommended actions include password reset, session revocation, enabling multi-factor authentication, and monitoring for unauthorized access attempts. Security teams should maintain blocking rules for the domain and related patterns, and search logs for connections to 104.21.37.85 and similar subdomain structures to identify additional infection vectors. Continued monitoring is advised due to potential redeployment under alternate subdomains.