dreammetatoken[.]live

Analysis conducted on July 26, 2026 confirms that dreammetatoken.live remains an active phishing domain targeting users of the MetaMask cryptocurrency wallet. The domain is currently returning an HTTP 403 Forbidden status, which may indicate a server-side restriction or a defensive measure to limit exposure while maintaining backend functionality. Infrastructure analysis reveals the domain is registered through GoDaddy.com, LLC, with nameservers ns17.domaincontrol.com and ns18.domaincontrol.com, a common configuration for domains hosted on GoDaddy’s infrastructure. This setup does not inherently indicate malicious activity but is consistent with domains used in phishing operations due to its accessibility and low-cost hosting options. The domain appears on at least one security blocklist, specifically PhishDestroy, which classifies it as malicious.

Additionally, five out of ninety-one security vendors on VirusTotal have flagged dreammetatoken.live as malicious, though the specific detection reasons or payloads are not detailed in available data. The combination of blocklist inclusion and vendor detections provides concrete evidence of its classification as a phishing threat, though the exact nature of the phishing content remains unconfirmed due to the 403 HTTP response. No Safe Browsing or Open Threat Exchange (OTX) data is currently available for this domain, limiting additional context on its distribution or attack vectors. Defenders should treat this domain as high-risk and implement blocking measures at both the network and endpoint levels.

Given the domain’s association with MetaMask—the name 'dreammetatoken' suggests an attempt to mimic legitimate MetaMask services—organizations handling cryptocurrency transactions or wallet-related traffic should prioritize monitoring and restricting access to this domain. The registrar, GoDaddy, has not taken enforcement action as of this report, and the domain remains active.