metamask[.]io-token[.]vip

This domain, metamask.io-token.vip, is identified as a brand impersonation phishing site specifically targeting MetaMask cryptocurrency wallet users. Analysis confirms the domain was designed to deceive visitors into disclosing sensitive credentials or private keys under the guise of token-related services. The site is currently classified under the threat type of cryptocurrency wallet phishing, with a focus on credential harvesting and fraudulent asset transfers. Infrastructure analysis reveals the domain was registered through West263 International Limited on November 22, 2025, and resolves to the IP address 103.226.124.208, hosted by AS55933 Cloudie Limited in Hong Kong. Detection metrics indicate the domain is flagged by 19 out of 95 security vendors on VirusTotal, while appearing on one security blocklist. Notably, the domain lacks an SSL certificate, increasing the risk of unencrypted data interception. The page title, metamask.io-token.vip, directly mirrors the domain name, a common tactic to reinforce perceived legitimacy. As of the latest assessment, metamask.io-token.vip has been taken offline, though residual risks may persist through cached pages or secondary distribution channels. Users are advised to verify wallet addresses through official MetaMask channels and avoid interacting with domains mimicking token-related services. Organizations should update blocklists to include this domain and its associated IP, while monitoring for similar registration patterns involving West263 International Limited or Cloudie Limited infrastructure. Immediate revocation of any credentials exposed to this domain is strongly recommended.