ww25[.]metamask[.]co[.]uk

This domain, ww25.metamask.co.uk, was registered on February 21 2026 through Stenning Limited trading as Client Domain Management. It is hosted on Cloudflare infrastructure, resolving to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, indicating a valid HTTPS endpoint. An HTTP request to the root URL returns a 403 status code, and the page title returned by the server is the German phrase “Nur einen Moment…”.

The site is detected by Cloudflare Browser Insights and HTTP/3, confirming the use of Cloudflare services. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain as malicious. Independent scanning by Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist. The phishing campaign is classified as a crypto scam that impersonates the MetaMask brand, and it has been blocked by the PhishDestroy service.

The risk rating is high and the operational status remains active. While the observed infrastructure confirms a typical Cloudflare‑based phishing setup, the exact phishing payload, credential‑harvesting pages, and redirect behavior have not been publicly disclosed. Defenders should proactively block the domain and its hosting IP at perimeter defenses, update URL filtering lists with the observed identifiers, and monitor for similar sub‑domains that resolve to the same Cloudflare IP range. Continuous re‑scanning of the domain is recommended to capture any changes in payload or hosting configuration.