web-ronin[.]typedream[.]app

This domain, web-ronin.typedream.app, poses a high-risk brand impersonation threat targeting users of the Backpack crypto wallet. The site mimics the Ronin Wallet interface, specifically referencing Axie Infinity in its page title, to deceive visitors into disclosing sensitive credentials or authorizing malicious transactions. The primary objective appears to be crypto asset theft, leveraging social engineering tactics to exploit trust in established wallet brands. Analysis indicates the domain was registered on February 21, 2026, through Squarespace Domains II LLC, an unusual registrar choice for legitimate crypto services. It resolves to IP address 172.67.206.36, hosted on Cloudflare infrastructure (AS13335), which is frequently abused for phishing operations due to its accessibility and anonymity features. The domain is flagged by 16 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists, including those maintained by cryptocurrency-focused threat intelligence providers. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent legitimacy, as malicious actors routinely obtain valid certificates for fraudulent domains. If a user has visited web-ronin.typedream.app or interacted with its content, immediate action is required. First, revoke any active wallet authorizations or connected dApp permissions associated with the Backpack or Ronin wallets. This can be done through the official wallet interfaces or blockchain explorers. Second, transfer all crypto assets to a new, secure wallet with a fresh seed phrase, as credentials may have been compromised. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams or fraud reporting platforms. Avoid reusing passwords or seed phrases across services, and enable multi-factor authentication where available to mitigate future risks.