secure-memasklogin[.]typedream[.]app

This domain, secure-memasklogin.typedream.app, was observed hosting a page titled “MetaMask Login – Securely Access Your Web3 Wallet.” The page title explicitly references the MetaMask brand, indicating an attempt to impersonate the cryptocurrency wallet service. The site resolves to IP address 104.21.37.85, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The hosting infrastructure includes Google Cloud services, as indicated by the presence of Node.js, React, Next.js, Google Cloud Trace, and Google Cloud CDN, alongside Cloudflare Browser Insights and Cloudflare CDN. The TLS certificate is issued by Google Trust Services under the WE1 leaf, confirming the use of a valid public certificate.

HTTP requests to the host return a 404 status, and the domain has been taken offline. Independent analysis by VirusTotal recorded 15 detections out of 95 scanned security vendors, and the domain appears on a single security blocklist, where it was also blocked by the PhishDestroy service. Registration was performed through the Typedream platform. The observed indicators collectively suggest a crypto‑related impersonation campaign targeting MetaMask users.

At present no forensic snapshot of the page content is available, so the exact malicious payload cannot be confirmed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and incorporate the identified IP and certificate fingerprint into threat intelligence feeds. Ongoing vigilance is recommended to detect any re‑registration or similar patterns leveraging the same hosting stack.