browser-metmask-ext[.]typedream[.]app

Analysis of the domain browser-metmask-ext.typedream.app, observed on 23 July 2026, indicates a high‑risk brand‑impersonation campaign targeting MetaMask users. The site resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and the registration record also lists Cloudflare as the registrar, confirming the use of Cloudflare’s infrastructure for anonymity. The SSL certificate presented is issued by Google Trust Services under the WE1 trust identifier, providing a legitimate‑looking HTTPS indicator despite the malicious intent. Google Safe Browsing has classified the URL as a social‑engineering threat, and the domain appears on a single security blocklist, where it was subsequently taken offline and is now reported as “offline”.

PhishDestroy has listed the domain as blocked, reinforcing its malicious status. VirusTotal analysis shows that 16 of 95 scanned security vendors flag the domain, reflecting a consensus of malicious behavior among a minority of scanners. The HTTP response returned a 403 status code, which may be a defensive measure or part of the phishing infrastructure. The page title retrieved is “Metamask Extension – How to Add MetaMask Extension to Chrome”, directly referencing the MetaMask brand and suggesting a wallet/seed phishing kit designed to harvest private keys or seed phrases.

No nameserver records were found, limiting further infrastructure mapping. Uncertainty remains regarding the full payload delivered to victims, as the site content was not captured beyond the title, and the exact phishing workflow is not disclosed. Defenders should immediately block the domain and the associated IP address at perimeter and DNS layers, monitor for similarly constructed subdomains under the typedream.app namespace, and enforce strict verification of MetaMask‑related communications.