secure-metamask-com-t-cdn[.]typedream[.]app

Analysis of the domain secure-metamask-com-t-cdn.typedream.app, observed on July 29 2026, indicates active involvement in crypto‑drainer campaigns. The domain was registered on June 08 2026 through the Typedream platform, a service commonly used for rapid site deployment, and resolves to the IP address 188.114.97.3. Multiple reputable security feeds have already taken action: PhishDestroy, MetaMask’s own protection list, and the SEAL blocklist all contain the domain, confirming that industry‑wide mitigation mechanisms consider it malicious. VirusTotal scans show that 15 of 91 antivirus and URL‑reputation engines flag the domain, providing independent corroboration of its hostile nature. In addition, three public blocklists currently list the host, further limiting its accessibility to end users.

The available infrastructure evidence is limited to the registrar and hosting details; no public SSL certificate, HTTP response code, or page title has been disclosed in the intelligence set, leaving those vectors unverified. Absence of a known page title or Safe Browsing identifier does not imply benign behavior, only that the data have not yet been harvested. The IP address 188.114.97.3 is associated with a shared hosting environment, a pattern frequently observed in fast‑flux or throwaway sites used for credential harvesting and fund diversion. No attribution to a specific threat actor or toolkit is present, and no Open Threat Exchange identifiers have been reported.

Given the convergence of registration timing, blocklist presence, and multi‑vendor detections, defenders should treat the domain as high‑risk. Recommended actions include adding the host to network‑level deny lists, updating endpoint URL filtering policies to block connections to 188.114.97.3, and monitoring DNS logs for any resolution attempts.