browser-metam-mask-en[.]typedream[.]app

The domain browser-metam-mask-en.typedream.app was observed delivering a MetaMask brand impersonation campaign aimed at crypto‑related victims. Google Safe Browsing flagged the site for social engineering, and VirusTotal recorded detections from 11 of 95 security vendors, confirming its malicious intent. The page title returned by the server, "MetaMask Extension | Getting Started: Wallet Extension," explicitly references the targeted wallet extension, reinforcing the brand‑impersonation profile. Infrastructure analysis shows the site was hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3, located in the United States. The TLS certificate was issued by Google Trust Services under the WE1 root, indicating the use of Google‑managed HTTPS termination despite the malicious payload.

Technical fingerprints include a stack of modern web technologies: Node.js, React, Next.js, Webpack, Google Cloud services, and Cloudflare CDN, all typical of a dynamically generated front‑end. The HTTP response returned a 404 status, suggesting the content may have been removed or the site was configured to serve error pages after a takedown. Registration details reveal the domain was provisioned through the Typedream website‑builder platform; no explicit nameserver information is available. The domain appears on one security blocklist and is actively blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken remedial action. Current status indicates the site is offline, but the underlying infrastructure—particularly the shared Cloudflare IP and the Typedream builder—remains reusable for future campaigns.

Defenders should therefore add both the fully qualified domain name and the resolved IP address to deny‑list rules across DNS, web proxy, and firewall layers. Monitoring for new Typedream‑hosted subdomains that reference MetaMask or display similar page titles is recommended, as the attacker may reuse the same tooling.