web-extnsion-metmmask[.]typedream[.]app

This domain, web-extnsion-metmmask.typedream.app, poses a targeted brand impersonation threat against MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site mimics legitimate MetaMask resources by presenting a deceptive page titled 'MetaMask Wallet: What is it and How to Get Started?', designed to trick users into disclosing sensitive credentials or installing malicious software. The fraudulent infrastructure leverages social engineering tactics, exploiting trust in the MetaMask brand to facilitate unauthorized access to digital assets or personal data. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating broad consensus among detection engines regarding its malicious nature. It is registered through Typedream, a platform not inherently malicious but frequently abused for rapid deployment of phishing sites. The domain resolves to IP address 188.114.96.3, hosted under Cloudflare’s AS13335, a common obfuscation tactic to mask origin servers. It appears on one security blocklist and uses a Google Trust Services SSL certificate (WE1), which, while valid, does not mitigate the underlying threat. The site is currently offline, suggesting takedown action or voluntary suspension by the threat actor. Users who visited web-extnsion-metmmask.typedream.app should immediately assume potential exposure. If any credentials were entered, revoke access to associated MetaMask accounts and enable multi-factor authentication on all linked services. Monitor connected wallets for unauthorized transactions and consider rekeying or migrating funds to a new secure wallet. Scan local devices for malware using updated security tools, as phishing sites often deploy secondary payloads. Report the incident to relevant financial or cryptocurrency platforms to aid in broader threat mitigation efforts. Exercise heightened caution with any communication or site referencing MetaMask, particularly those hosted on non-official domains.