# PhishDestroy threat dossier — metmsk-extension.gr.com ================================================================ Fetched: 2026-08-01 00:14:13 UTC Canonical: https://phishdestroy.io/domain/metmsk-extension.gr.com/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 68/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: MetaMask (and: arbitrum, ethereum, ledger, metamask, optimism) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 159.198.39.251 (US, Phoenix) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registrar: REGISTRAR_NOT_FOUND Nameservers: a.dnspod.com, b.dnspod.com, c.dnspod.com Page title: Metamask wallet extension — Official Resource HTTP response: 302 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE1 Expires: 2026-10-19 Status: INVALID chain Fingerprint: 192913d56684f7e07743ccd5d611129e32351ee3fe109de4adc9f72bdde94978 Subject Alternative Names (related infrastructure — often same operator): - www.metmsk-extension.gr.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-30 21:34:00 UTC (by PhishDestroy tracker) Last verified: 2026-08-01 00:41:35 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fb486-d42b-7339-a7e8-b21a3d960aa0/ Wayback Machine: https://web.archive.org/web/*/metmsk-extension.gr.com crt.sh CT logs: https://crt.sh/?q=%25.metmsk-extension.gr.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=metmsk-extension.gr.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/metmsk-extension.gr.com URLhaus: https://urlhaus.abuse.ch/host/metmsk-extension.gr.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-30 21:34:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] metmsk-extension.gr.com phishing site impersonates browser This domain, metmsk-extension.gr.com, is flagged as an active high-risk phishing site targeting browser extension users. Analysis conducted on July 30, 2026, confirms the domain remains operational, resolving to IP address 159.198.39.251. Infrastructure review shows nameservers hosted by DNSPod (a.dnspod.com, b.dnspod.com, c.dnspod.com), a provider frequently observed in phishing campaigns due to its low-cost DNS management services. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal detection data indicates one security vendor has flagged the domain as malicious, though the specific detection context or brand impersonation is not detailed in available telemetry. No registrar, ASN, or hosting provider details are currently available in the intelligence feed. The domain's SSL certificate and HTTP response status have not been analyzed, leaving encryption and server behavior unverified. The exact content or phishing kit in use remains unconfirmed; no page title, brand target, or scam type classification is provided in the data. Defenders should treat this domain as a confirmed phishing threat, particularly for campaigns distributing malicious browser extensions or credential-harvesting pages. Network-level blocking of the domain and its resolved IP (159.198.39.251) is recommended. Further investigation into associated infrastructure, such as co-hosted domains or linked IPs, may reveal additional compromised assets. Monitoring for new detections or blocklist additions is advised, as the domain's current low detection rate does not guarantee safety. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: e8a3b18244b1b1246a30cc006f6e3d93 TLS cert SHA-256: 192913d56684f7e07743ccd5d611129e32351ee3fe109de4adc9f72bdde94978 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/metmsk-extension.gr.com/ JSON API: https://api.destroy.tools/v1/check?domain=metmsk-extension.gr.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,231 domains (101,034 alive under monitoring, 27,265 confirmed neutralized). Site: https://phishdestroy.io