metamasknotifications[.]pro

This domain is an active credential harvesting site designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The site targets users by mimicking legitimate MetaMask notifications or login portals, tricking victims into entering sensitive credentials such as wallet seed phrases, private keys, or passwords. Once obtained, these credentials can be used to drain cryptocurrency assets from compromised wallets, leading to irreversible financial losses. The domain employs social engineering tactics, including urgency or fake security alerts, to pressure users into disclosing their information without verifying the site's authenticity. Analysis indicates this domain was registered on February 21, 2026, through a registrar known for hosting malicious infrastructure. It resolves to the IP address 84.32.84.32 and is currently flagged by 8 out of 95 security vendors on VirusTotal as malicious. The domain appears on three security blocklists and is blocked by multiple threat intelligence platforms. Infrastructure analysis reveals the domain is parked under a Hostinger DNS system, though it is actively serving phishing content rather than remaining dormant. The use of a future creation date (2026) suggests an attempt to evade detection by appearing as a newly registered domain with no prior reputation. If a user has visited metamasknotifications.pro or entered any credentials on the site, immediate action is required. First, disconnect the device from the internet to prevent further data exfiltration. Next, revoke any active sessions or authorizations associated with the MetaMask wallet, particularly those linked to the compromised credentials. Users should generate a new wallet and transfer all remaining assets to the new address, ensuring the old wallet is no longer used. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the targeted service and relevant cybersecurity authorities to aid in takedown efforts. Finally, scan the device for malware using updated security tools to ensure no additional compromise has occurred.