airdrop-metamask-redeem[.]com

The domain airdrop-metamask-redeem.com has been identified as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis confirms the domain was actively designed to deceive users into believing it was an official MetaMask airdrop or redemption portal. As of the latest assessment, the domain has been taken offline, though its prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered on September 02, 2025, through GoDaddy.com, LLC, and resolved to the IP address 3.167.227.97. The site was hosted on an Nginx server running OpenResty and displayed the page title 'BNB Chain: Build for the Next Billion Web3 Users,' a likely attempt to mimic legitimate blockchain-related content. Security vendors detected the threat early, with 2 of 95 VirusTotal vendors flagging the domain as malicious. Additionally, the domain appeared on one security blocklist and received a trust score of 0/100 from Gridinsoft, indicating a high likelihood of fraudulent intent. The use of a newly registered domain combined with cryptocurrency-themed branding aligns with common tactics used in crypto drainer and wallet compromise schemes. Current status indicates the domain is offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant, as similar infrastructure may reappear under different domains. Recommended actions include monitoring for newly registered domains impersonating MetaMask or other cryptocurrency services, blocking the IP address 3.167.227.97 at the network level, and educating users on verifying official domains before interacting with airdrop or redemption offers. Historical indicators, such as the domain registration date and associated IP, should be incorporated into threat intelligence feeds for proactive detection of related activity.