metamask[.]biz[.]id

The domain metamask.biz.id was observed hosting a wallet/seed phishing page titled "Metamask Airdrop Checker" and is attributed to a known Airdrop Scam phishing kit. The site lacked an SSL certificate, indicating that traffic was transmitted over HTTP without encryption. Infrastructure analysis shows the domain resolves to the IP address 170.187.228.163, which is allocated to Akamai Connected Cloud in Singapore (AS63949). Registration records link the domain to the Linode hosting platform under the same ASN, confirming the hosting provider.

Nameserver configuration uses ns1.domainesia.net and ns2.domainesia.net, both typical of domainesia services. VirusTotal scans reported 12 detections out of 95 security vendors, providing independent confirmation of malicious behavior. The domain appears on at least one security blocklist and has been actively blocked by the PhishDestroy service. Current monitoring indicates the site is offline, but historical evidence confirms it was used to impersonate the MetaMask brand and solicit private wallet seeds under the guise of an airdrop check.

While the page title and kit provide clear evidence of the scam’s intent, no additional content details have been captured, leaving the exact user‑facing elements undocumented. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor the associated IP range for any re‑deployment of similar phishing infrastructure. Users should be warned that any unsolicited request to verify MetaMask airdrops is unsolicited and likely malicious, and they should never disclose private keys or seed phrases to such sites.