help-metmask[.]typedream[.]app

This domain is flagged for elevated-risk brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site was designed to deceive users into disclosing sensitive credentials or private keys under the guise of a legitimate extension download. The page title, 'ḾetáMásk Extension – Your Gateway to the Decentralized Web,' employs Unicode homoglyphs to closely mimic the authentic MetaMask branding, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered through Typedream and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), which, while technically valid, does not mitigate the malicious intent of the domain. VirusTotal detections report 11 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on one security blocklist and was proactively taken offline following detection. No creation date is available, but the rapid flagging by multiple sources suggests recent deployment. Mitigation against this type of threat requires heightened user awareness and technical controls. Organizations should implement domain monitoring to detect Unicode-based spoofing attempts, particularly those targeting financial or cryptocurrency-related services. End-users should verify domain authenticity by cross-referencing official sources before entering credentials or downloading software. Network-level blocking of the domain and its associated IP (188.114.97.3) is recommended for enterprise environments. Security teams should also prioritize detection of homoglyph attacks in web filtering and email security solutions to prevent similar impersonation attempts.