metasafe[.]ai

The domain metasafe.ai has been identified as a brand impersonation threat specifically targeting users of the Across Protocol, a cross-chain bridging platform. Analysis indicates this domain was designed to deceive visitors by presenting itself as a legitimate cryptocurrency wallet risk analysis tool, with the page title 'Metasafe - Crypto Wallet AML Risk Analysis.' As of the latest verification, the domain has been taken offline, though prior activity remains a concern for potential victims. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 07, 2025, and resolved to the IP address 188.114.96.3. Security vendor detections on VirusTotal indicate that 11 out of 95 vendors flagged this domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy. Additional technical indicators include the use of Cloudflare for hosting, Proton Mail for communication, and Webflow for site development. The SSL certificate is issued by Google Trust Services, and the site supported HTTP/3. Gridinsoft assigned a trust score of 0/100, further confirming its malicious nature. Given the domain's current offline status, the immediate threat to new visitors is mitigated. However, organizations and individuals should remain vigilant for similar impersonation attempts, particularly those targeting cryptocurrency users. It is recommended to block the domain and its associated IP address (188.114.96.3) at the network level. Users who may have interacted with this domain should monitor their cryptocurrency wallets for unauthorized transactions and consider revoking any connected smart contract approvals. Security teams are advised to update detection rules to include this domain and its indicators of compromise in threat intelligence feeds.