metamasktrade[.]net

The domain metamasktrade.net is identified as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. This domain is classified as a high-risk phishing infrastructure designed to deceive users into disclosing sensitive credentials, including wallet private keys or recovery phrases, under the pretense of legitimate MetaMask services. As of the latest verification, the domain has been taken offline, though its prior activity remains a documented security concern. Infrastructure analysis reveals that metamasktrade.net resolved to the IP address 8.209.75.7 and was registered through Gname.com Pte. Ltd. on February 21, 2026. The domain was flagged by 10 of 95 security vendors on VirusTotal, indicating broad detection as malicious. Google Safe Browsing also classified it as phishing. The site lacked an SSL certificate, a critical security indicator, and appeared on three independent security blocklists. The page title, 'MetaMaskTrade,' closely mimics the legitimate MetaMask brand, increasing the likelihood of successful social engineering. The domain is currently offline, reducing immediate exposure risk. However, organizations and individuals should remain vigilant, as threat actors frequently re-deploy similar infrastructure. Users are advised to verify domain authenticity by cross-referencing official MetaMask communications and using only verified URLs. Security teams should update blocklists to include this domain and its associated IP, monitor for related registrations, and educate users on identifying phishing attempts targeting cryptocurrency services. If interaction with this domain occurred, immediate credential rotation and wallet security reviews are recommended.