browser-metammask-en[.]typedream[.]app

The domain browser-metammask-en.typedream.app was observed hosting a malicious site that masquerades as the official MetaMask wallet extension. The page title returned by the server is “MetaMask Extension | Getting Started: Wallet Extension,” which directly references the targeted brand. The site resolves to the IP address 172.67.206.36, which belongs to Cloudflare’s AS13335 network located in the United States. The TLS certificate is issued by Google Trust Services under the “WE1” identifier, indicating a valid‑looking HTTPS connection.

Google Safe Browsing classifies the URL as social engineering, and fifteen of ninety‑five VirusTotal scanners have flagged it, confirming a reputation of malicious activity. HTTP requests receive a 403 response, suggesting that the content is currently inaccessible, and the domain is listed as offline by the monitoring service. Infrastructure analysis shows the use of Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, a stack commonly employed by phishing operators to deliver dynamic content. The domain was registered through Cloudflare, Inc., but no authoritative name servers were disclosed.

The site is currently blocked by PhishDestroy and appears on one additional security blocklist. While the exact phishing page layout has not been captured, the convergence of brand impersonation, a valid‑looking certificate, and multiple vendor detections indicates a high‑risk crypto‑scam campaign targeting MetaMask users. Defenders should add the domain and its resolving IP to blocklists, monitor for any re‑activation, and enforce strict URL filtering for any references to MetaMask extension installation. Additional traffic analysis of the Cloudflare IP range may reveal related infrastructure used by the threat actor.