sso-metamask-com-auth[.]typedream[.]app

This domain, sso-metamask-com-auth.typedream.app, poses a direct threat to cryptocurrency wallet security by impersonating MetaMask's official single sign-on (SSO) portal. The site mimics MetaMask's branding, login interface, and page title ('Log In | Metamask™ | Getting started with MetaMask™️') to deceive users into entering their wallet credentials, seed phrases, or private keys. Once submitted, this sensitive information is harvested by threat actors, enabling unauthorized access to victims' digital assets and leading to potential financial theft. The site specifically targets users who may be redirected from malicious ads, phishing emails, or compromised third-party services, exploiting trust in the MetaMask brand to bypass security awareness. Analysis indicates this is a confirmed credential harvesting operation with multiple technical indicators of compromise. The domain is flagged by 14 out of 95 security vendors on VirusTotal, including reputable engines specializing in cryptocurrency fraud detection. Infrastructure analysis reveals the site was hosted on Cloudflare's network (AS13335) at IP address 172.67.206.36, a common tactic to obscure the true origin and leverage Cloudflare's CDN services for rapid deployment. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy while the domain registration through Typedream's platform suggests abuse of a legitimate website builder service. The page title and MetaMask branding were meticulously replicated, including trademark symbols, to enhance the illusion of authenticity. If you visited sso-metamask-com-auth.typedream.app or entered any credentials, immediate action is required to mitigate risk. First, disconnect any active sessions from the site and revoke access for all connected applications in your MetaMask wallet settings. Next, transfer all digital assets to a new wallet with a fresh seed phrase, as the original credentials may already be compromised. Monitor all linked accounts for unauthorized transactions and enable transaction alerts if available. Report the incident to the platform where you encountered the link (e.g., social media, email provider) to prevent further victimization. Users should also scan their devices for malware, as phishing sites often serve as entry points for broader compromise. For future protection, always verify domain authenticity by cross-referencing with MetaMask's official documentation and using bookmarked links for access.