mmt-finance[.]typedream[.]app

On July 25, 2026, analysis of the domain mmt-finance.typedream.app identified it as a brand-impersonation infrastructure that has been taken offline. The site presented the page title “Momentum | Move Central Liquidity Engine – app.mmt.finance”, indicating an attempt to reference a financial-related service. The TLS certificate was issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate chain. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP requests return a 403 status, suggesting the server is configured to deny access after the takedown.

Registration details show the domain was provisioned through Cloudflare, Inc., and the nameserver lookup returned NS_NOT_FOUND, indicating that standard DNS records are not currently exposed. Technical fingerprints reveal a stack comprising Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare, and Webpack, consistent with modern web application deployments. VirusTotal recorded nine detections out of ninety-five scanners, and the domain appears on a single external blocklist. PhishDestroy has also flagged the site and contributed to its offline status.

The brand target is listed as “across”, meaning the campaign may have been aimed at multiple brands rather than a single named entity. For defenders, the immediate recommendation is to block both the domain name and its associated IP address at perimeter defenses, update URL filtering and threat-intel feeds to include the observed indicators, and monitor for any resurgence of similar Cloudflare-hosted infrastructure using the same technology stack. Continuous verification of DNS resolution and certificate transparency logs is advised to detect re-registration attempts. Organizations should also review email authentication controls to mitigate credential-phishing attempts that reference the “Momentum” branding.