# PhishDestroy threat dossier — metamaskcard.live ================================================================ Fetched: 2026-05-11 14:14:19 UTC Canonical: https://phishdestroy.io/domain/metamaskcard.live/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 56/100 (PhishDestroy scoring — see methodology below) Targeted brand: MetaMask ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 9/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, CRDF, CyRadar, Ermes, Emsisoft, Fortinet, Netcraft, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 Registrar: NameSilo, LLC !!! REGISTRAR INTEGRITY ALERT — NameSilo !!! NameSilo is a registrar documented by PhishDestroy as (1) publicly lying about received abuse reports, (2) shielding a $20M+ Monero-theft operation (xmrwallet.com) for 10 continuous years, and (3) retaliating against PhishDestroy by getting our X/Twitter account @Phish_Destroy banned after we published the evidence. Researchers/victims must ALWAYS CC compliance@icann.org on every abuse ticket — NameSilo has a track record of later claiming reports were never received. Primary sources: https://phishdestroy.io/namesilo-killed-our-twitter https://phishdestroy.io/xmrwallet-namesilo-exposed Nameservers: jimmy.ns.cloudflare.com, linda.ns.cloudflare.com Registered: 2026-04-12 Expires: 2027-04-12 HTTP response: 403 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-12 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-11 15:53:32 UTC (by PhishDestroy tracker) Last verified: 2026-05-11 16:56:06 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e1717-9e26-7418-8c97-0a230a2efc94/ URLQuery: https://urlquery.net/report/ee648db8-3db5-4a64-a21d-6a648fb001d8 Wayback Machine: https://web.archive.org/web/*/metamaskcard.live crt.sh CT logs: https://crt.sh/?q=%25.metamaskcard.live Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=metamaskcard.live AlienVault OTX: https://otx.alienvault.com/indicator/domain/metamaskcard.live URLhaus: https://urlhaus.abuse.ch/host/metamaskcard.live/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-11 15:54:09 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies metamaskcard.live as an active brand impersonation scam targeting MetaMask users. This domain masquerades as the official MetaMask platform to deceive visitors into surrendering sensitive wallet credentials or installing malicious extensions. The threat actor behind this operation leverages the trust associated with MetaMask's brand recognition to manipulate victims into engaging with fraudulent services, including fake wallet interfaces or phishing forms disguised as legitimate login portals. Users arriving at this domain are immediately exposed to credential harvesting risks, with the potential for subsequent cryptocurrency theft or account takeover. The attackers' tactics rely on visual similarities to MetaMask's branding, including domain naming conventions and UI elements, to lower user suspicion during the initial interaction. Technical analysis of metamaskcard.live reveals alarming indicators that confirm its malicious nature. The domain was registered on April 12, 2026, through NameSilo, LLC, a registrar known for accommodating high-risk registrations. Security assessments conducted via VirusTotal detected malicious activity, with 9 out of 95 participating vendors flagging the domain as harmful. This domain resolves to IP address 188.114.96.3 and utilizes a legitimate SSL certificate issued by Let's Encrypt, a technique commonly employed by threat actors to establish false trust through encrypted connections. The combination of a recently registered domain, high blocklist coverage, and infrastructure choices suggests an ongoing campaign rather than an opportunistic attack, with the attackers likely iterating on previous successful campaigns. If you have visited metamaskcard.live, take immediate action to secure your MetaMask assets and accounts. First, check your browser extensions for any unauthorized or unfamiliar MetaMask-related add-ons—remove them immediately. Next, review your MetaMask transaction history for any signs of unauthorized transfers; if detected, revoke connected token approvals through MetaMask's interface or your wallet's official platform. Change your MetaMask password using the official website (metamask.io) and enable two-factor authentication to prevent future unauthorized access. Consider transferring remaining assets to a new wallet via a hardware device if you suspect your seed phrase or private keys may have been compromised. Report this domain to MetaMask's official phishing reporting channels and your browser's safe browsing service to help protect others from falling victim to this impersonation scam. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 675157d9f421c6f659fc772ae73166b7 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/metamaskcard.live/ JSON API: https://api.destroy.tools/v1/check?domain=metamaskcard.live Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 148,214 domains (45,139 alive under monitoring, 102,795 confirmed takedowns/dead). Site: https://phishdestroy.io