metamaskrecovery[.]onrender[.]com

On July 23, 2026 the domain metamaskrecovery.onrender.com was identified as a brand‑impersonation site targeting MetaMask. The site presented a page title of "Metamsk_Restore" and was classified as a crypto‑scam. Infrastructure analysis shows the domain resolves to IP address 216.24.57.251, which is announced by ASN 397273 owned by Render and geolocated to the United States. The domain is registered through Render Services Inc. and uses the authoritative nameserver ns.render.com, indicating deployment on the Render cloud platform.

TLS termination is provided by a Google Trust Services certificate (WE1), confirming that a legitimate certificate authority was used for encryption. Network‑level observations reveal the site employed Cloudflare and HTTP/3, but an HTTP request returned a 404 status, suggesting that the malicious payload is no longer being served or was removed prior to scanning. VirusTotal analysis recorded 15 detections out of 95 security vendors, and the domain appears on a single external security blocklist. It has been taken offline and is currently blocked by the PhishDestroy feed.

While the observed indicators confirm the domain’s use for a MetaMask‑related crypto‑recovery scam, the exact page content and any associated credential‑capture mechanisms remain unknown due to the 404 response. Defenders should immediately block the domain and its resolving IP, continue to monitor Render‑hosted subdomains for similar naming patterns, and apply URL‑filtering rules for known phishing feeds such as PhishDestroy. Ongoing vigilance is advised because the underlying hosting provider may be leveraged for future impersonation campaigns.