buy-metamask[.]typedream[.]app

Analysis shows that buy-metamask.typedream.app resolves to the Cloudflare‑owned address 172.67.206.36, announced in the AS13335 network and geolocated to the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services under the WE1 profile, indicating a valid TLS handshake despite its malicious purpose. HTTP requests to the host return a 403 status code, a response often used by compromised or takedown‑initiated pages to prevent content delivery. Technical fingerprints reveal a stack comprising Node.js, React, Next.js, Google Cloud services, Google Cloud Trace, Google Cloud CDN, Cloudflare, and Webpack, suggesting the infrastructure was built on modern web development frameworks and leveraged a content delivery network for scalability.

The domain was registered on February 21, 2026 through Squarespace Domains II LLC, and its page title is reported as "Suspected phishing site | Cloudflare," confirming that the site has been flagged by the hosting provider. Threat intelligence sources classify the site as a brand‑impersonation campaign targeting MetaMask, with a crypto‑scam motive, and the Gridinsoft trust score assigns a rating of 0 out of 100, indicating extreme malicious confidence. PhishDestroy has already taken the domain offline, and it appears on one security blocklist; however, the presence of the domain on VirusTotal shows that 11 of 93 scanning engines still flag it, reinforcing the malicious assessment.

Defenders should immediately block both the domain and its associated IP address at perimeter defenses, incorporate the domain into URL filtering policies, and monitor for any re‑registration attempts or similar sub‑domains that reuse the same technology stack or SSL issuer. Continuous ingestion of threat feeds that reference this domain, combined with periodic re‑scans of the IP address, will help detect potential resurgence or related infrastructure.