metamask-download[.]com

Analysis of metamask-download.com indicates a high-risk brand impersonation domain targeting MetaMask users. The domain was registered on July 6, 2026, six days before this assessment, and resolves to IP 94.183.168.63, hosted on AS213995 (Belenkii Ivan Alexandrovich) in Russia. Nameservers point to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern commonly observed in malicious infrastructure. The site returns an HTTP 200 status, suggesting an active frontend, and uses a Let's Encrypt SSL certificate (YR1), which provides encryption but does not validate legitimacy. The page title, 'The Ultimate Crypto Wallet for DeFi, Web3 Apps, and NFTs | MetaMask,' directly mirrors MetaMask's official branding, confirming the intent to deceive users. The domain is flagged by 19 of 91 security vendors on VirusTotal, with additional detections across four security blocklists, including PhishDestroy, SEAL, and PhishingDB. AlienVault OTX lists the domain in 50 threat intelligence pulses, reinforcing its association with malicious activity. The scam type is classified as a crypto drainer, a scheme designed to siphon cryptocurrency from victims' wallets. Infrastructure analysis reveals the use of Contentful and React, technologies not inherently malicious but frequently employed in phishing kits for rapid deployment. The domain's trust score from Gridinsoft is 0/100, further corroborating its fraudulent nature. Defenders should treat this domain as an active threat, block resolution at the DNS level, and monitor for related indicators of compromise. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, recent registration, and security vendor detections provides sufficient evidence for immediate mitigation.