metamask-help[.]typedream[.]app

The domain metamask-help.typedream.app was created on February 21, 2026 and is currently offline, returning an HTTP 404 response. It resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain but offering no assurance of legitimacy. Registration records show the domain was purchased through Squarespace Domains II LLC, a registrar commonly used for legitimate web services but also for malicious actors.

VirusTotal scans have flagged the domain in 13 of 95 security‑vendor engines, demonstrating moderate detection across multiple vendors. The site is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy platform, confirming that at least one anti‑phishing service has taken action against it. Technical fingerprinting reveals a stack consisting of Node.js, React, Next.js, and Google Cloud services (including Cloud Trace and Cloud CDN), all fronted by Cloudflare’s performance and security layers such as Cloudflare Browser Insights. The page title captured from the site reads "Getting started with MetaMask | MetaMask Help Center," directly referencing the MetaMask brand and aligning with the reported brand‑impersonation and crypto‑scam classification.

While the presence of a legitimate‑looking certificate and reputable hosting components may reduce superficial suspicion, the combination of brand‑specific page title, detection by multiple vendors, and blocklist inclusion indicates a clear malicious intent to lure MetaMask users. Defenders should add the domain and its associated IP to network‑level deny lists, monitor for any resurgence of the domain or similar sub‑domains, and ensure endpoint protection solutions are updated with the latest indicator‑of‑compromise data.