metmsk-chrome-exten[.]typedream[.]app

This domain is flagged as an elevated-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. The site mimics the official MetaMask Chrome extension onboarding process, presenting a high-fidelity replica of the legitimate getting-started page. Analysis indicates the domain is designed to harvest wallet credentials, seed phrases, or distribute malicious browser extensions under the guise of a trusted brand. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, resolving to IP address 188.114.96.3 (AS13335, United States). The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. As of the latest scan, 18 out of 95 security vendors on VirusTotal detect the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is registered through Cloudflare, Inc. The page title, 'MetaMask® Chrome Extension® — Getting Started: Wallet ...,' directly mimics the official MetaMask branding to deceive users. Mitigation requires immediate user awareness and technical controls. Users should verify the authenticity of any MetaMask-related download by accessing the official website or Chrome Web Store directly, avoiding third-party links. Browser-based protections, such as enforcing strict extension installation policies or deploying endpoint detection rules for known malicious domains, can reduce exposure. Network-level blocking of the domain and its resolving IP (188.114.96.3) is recommended for enterprise environments. Cryptocurrency users should treat any unexpected extension installation prompts as high-risk events and report them to security teams for further analysis.