network-wallet-io[.]op-io[.]cc

Analysis of the domain network-wallet-io.op-io.cc indicates it was actively impersonating MetaMask, a cryptocurrency wallet service, as of its last known operational state. The domain was registered on January 4, 2025, through NameSilo, LLC, and resolved to the IP address 91.223.3.154, hosted on AS201814 (MEVSPACE sp. z o.o.) in Poland. At the time of assessment, no SSL certificate was present, increasing the risk of unencrypted data transmission.

Security vendors flagged the domain on VirusTotal, with 15 out of 95 engines detecting malicious activity, suggesting a consensus among multiple detection systems. The domain also appeared on at least one security blocklist, specifically PhishDestroy, which classified it as a threat prior to its takedown. The page title, 'MetaMask,' directly aligns with the reported brand impersonation, reinforcing the likelihood of fraudulent intent targeting cryptocurrency users. Infrastructure analysis reveals the use of Cloudflare nameservers (bingo.ns.cloudflare.com and yisroel.ns.cloudflare.com), a common tactic to obscure hosting details and evade immediate detection.

The domain is currently offline, but historical data confirms its association with crypto-related scams. Defenders should treat any prior interaction with this domain as high-risk, particularly if credentials or wallet details were entered. Given the absence of an SSL certificate and the domain's presence on blocklists, users should assume any data shared with this site was exposed. Further investigation into related infrastructure, such as the hosting IP or registrar history, may uncover additional malicious domains linked to the same threat actor.