doc-metamaskextension[.]typedream[.]app

This domain is flagged for elevated risk due to confirmed brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the infrastructure is designed to deceive users into disclosing sensitive credentials or wallet recovery phrases, likely for subsequent unauthorized transactions or account takeovers. The threat type is classified as brand impersonation with potential credential theft, not a generic phishing attempt, given the specific targeting of MetaMask’s branding and functionality. Infrastructure analysis reveals multiple high-confidence indicators. The domain, registered through Squarespace Domains II LLC on February 21, 2026, resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flag the domain at a ratio of 10/95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence provider. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as it is commonly exploited by threat actors to lend false legitimacy. The page title, 'Suspected phishing site | Cloudflare,' further corroborates the malicious intent, as Cloudflare’s warning system is triggered by suspicious activity patterns. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP at the network perimeter. Organizations should deploy browser-based protections to prevent user access and alert security teams to any attempted connections. End-users should be educated on verifying domain authenticity, particularly for cryptocurrency-related services, and instructed to cross-check URLs against official sources. Given the credential theft risk, affected users should revoke any active sessions, reset passwords, and monitor wallet transactions for unauthorized activity. Security teams are advised to review logs for connections to 188.114.97.3 or the domain to identify potential compromise vectors.