metamaskgrants[.]com

The domain metamaskgrants.com is active and was registered on August 4, 2023 through Cloudflare, Inc. It resolves to IP 104.21.48.1, an address owned by AS13335 Cloudflare, Inc., and is hosted behind Cloudflare DNS with nameservers micah.ns.cloudflare.com and vera.ns.cloudflare.com. The site returns an HTTP 301 status and presents the page title "MetaMask Grants DAO," indicating a brand‑impersonation attempt targeting MetaMask users. Technical analysis shows the presence of Varnish, GitHub Pages, HSTS, Fastly, Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting a layered CDN configuration. The SSL certificate is issued by Google Trust Services (WE1), a common certificate for Cloudflare‑fronted domains. Reputation data include a Gridinsoft trust score of 0/100 and a detection by one of 95 VirusTotal security vendors, confirming malicious intent. The domain appears on two security blocklists and is blocked by PhishDestroy and Enkrypt, reinforcing its classification as a high‑risk crypto scam. Content beyond the title has not been publicly analyzed, so the exact phishing mechanics remain uncertain. Defenders should immediately add metamaskgrants.com to deny‑list and DNS sinkhole policies, monitor for similar brand‑impersonation domains, and update web filtering rules to block Cloudflare‑hosted URLs that reference MetaMask. User education campaigns should warn against unsolicited communications promising MetaMask grants, and incident response teams should be prepared to investigate any credential submissions that may originate from this site.