metamask[.]apidocs[.]cloud

The domain metamask.apidocs.cloud was registered on December 25, 2024 through NameCheap, Inc. and is currently taken offline. Technical analysis shows that the host resolves to IP address 89.163.155.33, which is allocated to AS24961 WIIT AG in Germany. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy, indicating that at least one defensive organization has identified it as malicious. No SSL certificate is presented for the site, and the HTTP response returned the generic page title "Index of /," suggesting the presence of a default directory listing rather than a tailored phishing landing page.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of the host as highly untrusted. The authoritative nameservers are ns7.privatedns.vip and ns8.privatedns.vip, which are commonly associated with disposable or low‑reputation DNS services. VirusTotal scans have flagged the domain in nine out of ninety‑three security vendor detections, providing additional independent confirmation of malicious behavior. The intelligence categorizes the activity as a brand impersonation targeting MetaMask and labels the overall campaign as a crypto scam.

While the page content has not been captured, the combination of a brand‑specific target, lack of TLS, low trust score, blocklist listings, and multiple vendor detections strongly suggests that the domain was used to lure victims into credential‑stealing or fund‑draining operations. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to 89.163.155.33, and update endpoint protection signatures to include the observed detections. Further investigation could focus on retrieving archived snapshots of the site to confirm the exact phishing methodology and to identify any associated command‑and‑control infrastructure.