en-coinbase-help[.]typedream[.]app

The domain en-coinbase-help.typedream.app is currently listed as offline, returning an HTTP 404 status code, which prevents direct content inspection. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, hosted within the United States under AS13335 owned by Cloudflare, Inc. The SSL certificate presented is issued by Google Trust Services (WE1), indicating a valid TLS layer despite the malicious intent. Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports that 11 of 95 security vendors have identified it as malicious, reinforcing the high‑risk assessment.

The site is registered through Cloudflare, Inc., and has been added to at least one security blocklist, with PhishDestroy explicitly blocking it. Detected technologies include Node.js, React, Next.js, Google Cloud services (Trace, CDN), and Cloudflare Browser Insights, suggesting a modern web stack often used by fraudulent actors to emulate legitimate services. The page title "Coinbase Wallet - Your key to the world of crypto" directly references Coinbase, confirming the brand impersonation claim.

No nameserver information is available, and the absence of a live page limits further forensic detail. Defenders should add the domain to outbound filtering rules, monitor DNS queries for the associated IP, and advise users that any unsolicited communications referencing Coinbase Wallet originating from this host are fraudulent. Continuous telemetry on the IP address and associated Cloudflare‑hosted services is recommended to detect any future re‑activation of the domain.