tenderlymetamask[.]com

Analysis of tenderlymetamask.com indicates active brand impersonation targeting MetaMask, a cryptocurrency wallet service. The domain was registered on August 13, 2025, through GoDaddy.com, LLC, and currently resolves to IP address 159.65.149.254. Infrastructure review shows an SSL certificate issued via Plesk, a common hosting control panel, which may facilitate automated phishing deployments. The page title 'Trendly' does not match the expected MetaMask branding, suggesting either a placeholder or an attempt to obscure the site's true purpose. Security vendors have flagged the domain, with 5 of 95 detecting it as malicious. It appears on two security blocklists and has been referenced in 22 threat intelligence pulses on AlienVault OTX, indicating broader awareness of its malicious activity. The domain remains active as of July 12, 2026, with a trust score of 0/100, reinforcing its classification as high-risk. Defenders should treat this domain as a confirmed phishing resource and implement blocking measures at the network and endpoint levels. Further investigation into associated infrastructure, such as the hosting IP and SSL certificate issuer, may reveal additional linked threats. No evidence of a specific phishing kit or payload has been confirmed at this time.