web-page-metamask-login[.]typedream[.]app

This domain is an active brand impersonation site designed to deceive users into disclosing cryptocurrency wallet credentials. The page mimics MetaMask, a widely used Ethereum wallet interface, while also targeting Aave, a decentralized finance protocol. Visitors are presented with a fraudulent login portal that closely resembles the legitimate MetaMask onboarding process, complete with branding elements and a deceptive URL structure. The intent is to harvest seed phrases, private keys, or other sensitive authentication details, enabling attackers to drain digital assets from compromised wallets. Analysis indicates this domain was registered on February 21, 2026, through Squarespace Domains II LLC, an unusual timeline suggesting potential domain spoofing or backdating. It resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335), which is frequently exploited to obscure malicious origins. The domain appears on three security blocklists, and VirusTotal reports 19 out of 95 security vendors flagging it as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, a common tactic in phishing schemes to appear trustworthy. If a user has interacted with this domain, immediate action is required to mitigate risk. First, disconnect any active wallet sessions and revoke permissions for connected decentralized applications. Do not enter any recovery phrases or private keys into any platform. Scan the device for malware using reputable security tools, as credential theft may be accompanied by additional payloads. Monitor wallet transactions for unauthorized activity and consider transferring assets to a new, secure wallet if compromise is suspected. Report the domain to relevant security teams and cryptocurrency platforms to aid in takedown efforts and prevent further victimization.