metamaskcheck[.]live

The domain metamaskcheck.live is identified as a brand impersonation threat specifically targeting MetaMask, a cryptocurrency wallet service. Analysis confirms this domain was actively employed to deceive users into disclosing wallet credentials or interacting with malicious smart contracts. As of the latest verification, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 03, 2026, and resolved to the IP address 188.114.97.3. Security vendors flagged this domain in 6 of 95 VirusTotal scans, while it appeared on three distinct security blocklists. Technologies detected include Cloudflare and HTTP/3, which may have been leveraged to obfuscate malicious activity. The page title, 'metamaskcheck.live | 502: Bad gateway,' suggests recent disruption or misconfiguration prior to takedown. Given the domain's current offline status, immediate risk of active exploitation is reduced. However, organizations and individuals should remain vigilant for residual threats, such as cached malicious content or secondary domains linked to the same infrastructure. Recommendations include blocking the domain and associated IP at the network level, monitoring for related phishing campaigns, and educating users on recognizing brand impersonation tactics targeting cryptocurrency services. Historical logs should be reviewed for any prior interactions with this domain to assess potential exposure.