browser-matamsk-en[.]typedream[.]app

On July 24, 2026 the domain browser-matamsk-en.typedream.app was observed hosting a brand‑impersonation campaign targeting MetaMask. DNS resolution points to IP 188.114.97.3, an address owned by Cloudflare (AS13335) and geolocated to the United States. The site presented the page title “What Is MetaMask Chrome Extension,” a clear indicator of an attempt to lure MetaMask users. A TLS certificate issued by Google Trust Services (CN=WE1) was present, confirming that the domain served HTTPS traffic. HTTP probing returned a 404 status, suggesting that the malicious content has been taken down or is no longer served.

Scamadviser assigned a trust score of 11/100, and the domain is registered through Typedream, a platform commonly used for rapid site deployment. Infrastructure fingerprinting revealed a stack of Node.js, React, Next.js, Webpack, Google Cloud services and Cloudflare CDN, matching the typical technology profile of Typedream‑hosted sites. VirusTotal analysis flagged the domain by 11 of 95 scanning engines, providing independent confirmation of malicious intent. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service.

Current status is offline, but the underlying IP and hosting provider remain active. Uncertainty remains regarding the exact content that was served before the 404 response, as no page capture is available to confirm credential‑stealing forms or payloads. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for re‑registration or similar sub‑domains on Typedream that reference MetaMask, and enforce DNS sinkholing for any future resolution attempts. Security teams are advised to update web‑filtering signatures with the observed page title and TLS certificate details, and to educate users that official MetaMask extensions are distributed only through the Chrome Web Store and the official MetaMask website.