addons--mozilla--org[.]typedream[.]app

The domain addons--mozilla--org.typedream.app was registered on February 21, 2026 through Squarespace Domains II LLC and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 identifier, indicating the use of Google’s public PKI. Infrastructure fingerprints show a modern web stack: Node.js, React, Next.js, Webpack, and Google Cloud services, with content delivery accelerated by Cloudflare CDN and Cloudflare Trace.

The page title returned by the HTTP endpoint is "Trust Wallet – Get this Extension for Firefox (en-US)" and the HTTP response code is 404, suggesting that the expected resource is missing or the site is deliberately serving an error page. The domain appears on a single security blocklist, specifically PhishDestroy, and was flagged by two of ninety‑three VirusTotal scanners, reinforcing the suspicion of phishing intent. No additional analysis of the page content is available, and the site is currently taken offline, leaving the exact malicious behavior unconfirmed.

Defenders should treat the domain as a high‑confidence phishing indicator targeting Trust Wallet users, enforce blocking at DNS and proxy layers, and monitor related infrastructure for re‑appearance. Continuous observation of the hosting IP and associated Cloudflare assets is advised, as the same stack could be reused for future campaigns.