metmask-chr-extension[.]typedream[.]app

The domain metmask-chr-extension.typedream.app was observed as an impersonation of the MetaMask browser wallet, targeting users with a crypto‑scam profile. The site presented the page title "Getting Started: Wallet Extension | MetaMask® Chrome Extension," directly referencing the legitimate MetaMask brand. Infrastructure analysis shows the domain resolved to IP 188.114.97.3, hosted within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate was issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake but offering no assurance of legitimacy.

HTTP probing returned a 404 status, and the service is currently marked as offline, suggesting the hosting has been taken down or the site is no longer serving content. Technology fingerprinting identified a stack consisting of Node.js, React, Next.js, Google Cloud services (including Cloud Trace and CDN), and Cloudflare Browser Insights, consistent with a modern web application framework but not indicative of malicious functionality by itself. VirusTotal scanned the domain and recorded 10 detections out of 95 security vendors, confirming that a subset of scanners flagged the site as malicious. The domain appears on a single external blocklist and has been explicitly blocked by PhishDestroy.

The registrar information lists Cloudflare, Inc. as the registrar, and no nameserver records were retrievable. While the page title and brand targeting confirm a deliberate MetaMask impersonation, the exact content served, credential‑harvesting mechanisms, and user impact remain unverified due to the site’s offline status. Defenders should add the domain to internal URL blocklists, monitor the associated IP address for re‑use, and enforce brand‑specific detection rules for MetaMask‑related traffic. Ongoing threat‑intel feeds should be consulted for any re‑appearance of similar domains or infrastructure reuse.