webb-metamask--extension[.]typedream[.]app

Analysis date: July 24 2026. The domain webb-metamask--extension.typedream.app was registered on February 21 2026 via Squarespace Domains II LLC. Technical inspection shows the site is hosted behind Cloudflare (ASN 13335) with the origin IP address 188.114.96.3 located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming use of Google's certificate infrastructure. The HTTP response currently returns status code 403 and the site is listed as taken offline by the reporting team. Infrastructure fingerprints indicate a modern JavaScript stack: Node.js, React, Next.js, Webpack, and Google Cloud services including Cloud Trace and CDN, all delivered through Cloudflare.

The page title returned from the server is “Suspected phishing site | Cloudflare,” which is a generic warning page presented by Cloudflare when the host is blocked. The Gridinsoft trust score of 0 out of 100 further reflects a lack of reputation. Threat intelligence shows the domain appears on a single active blocklist and has been flagged by PhishDestroy. VirusTotal scans report that ten of ninety‑five antivirus and URL scanning engines marked the domain as malicious, consistent with a crypto‑related scam profile.

The listed scam type is “Crypto Scam” and the domain specifically impersonates the MetaMask brand, indicating an attempt to harvest cryptocurrency wallet credentials or lure users into fraudulent transactions. While the exact content of the page is not available because the site is offline and only the Cloudflare block page is observed, the combination of a newly created domain, low trust score, presence on a phishing blocklist, and multiple vendor detections provides strong evidence of malicious intent. Defenders should add the domain to network and endpoint blocklists, monitor DNS queries for the host, and ensure that any corporate MetaMask integrations are protected against credential‑stealing attempts.