metemaskio-extension[.]typedream[.]app

Analysis indicates that metemaskio-extension.typedream.app was provisioned to imitate MetaMask, as evidenced by the page title “Getting Started: MetaMask Extension(EN‑us)” and the explicit brand target “MetaMask”. The site resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s AS13335 network and is hosted in the United States. An SSL certificate issued by Google Trust Services (WE1) was observed, suggesting the use of Google Cloud services; additional technology fingerprints include Node.js, React, Next.js, Webpack, Google Cloud Trace, and Google Cloud CDN, all typical of modern web applications. The domain was registered through Cloudflare, Inc., but the authoritative nameservers could not be retrieved (NS_NOT_FOUND).

HTTP requests to the host return a 403 status code, and the domain has been taken offline as of the report date. Threat intelligence flags the site as a crypto‑related brand‑impersonation campaign; 14 of 95 VirusTotal scanners flagged the domain, and it appears on at least one external blocklist. The site was also listed by PhishDestroy as malicious. The elevated risk rating assigned by analysts aligns with the observed brand impersonation and vendor detections.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host, and add the IP address 188.114.97.3 to threat‑intel feeds. Because the site is currently offline, no further content analysis is possible, and the exact payload or credential‑ harvesting mechanism remains unknown. Ongoing observation of the hosting infrastructure and periodic re‑scans are recommended to detect re‑activation.