metamask-login-learn-us-sso[.]typedream[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Aave, a decentralized finance protocol. The site mimics legitimate authentication portals to harvest credentials, private keys, or seed phrases from unsuspecting users attempting to access cryptocurrency services. Analysis indicates a deliberate effort to exploit trust in the Aave brand, with page elements closely resembling official login interfaces, including the title 'Log-In | Metamask® | Getting started with MetaMask*' despite the domain's primary association with Aave. Infrastructure analysis reveals the domain metamask-login-learn-us-sso.typedream.app was registered through Squarespace Domains II LLC on February 21, 2026, and currently resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is detected by 18 out of 95 security vendors on VirusTotal, and appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious domains to evade basic HTTPS warnings. Notably, the creation date is anomalous, suggesting either a registration error or intentional obfuscation of the domain's true age. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.96.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint to endpoint detection systems. Users should be educated to verify domain authenticity before entering credentials, particularly for decentralized finance platforms. Multi-factor authentication (MFA) should be enforced where possible, and wallet software should never be accessed through links in emails or unverified sources. Organizations should monitor for internal traffic to the domain and investigate any connections as potential credential compromise incidents.