wailing-vegetable-low[.]on-fleek[.]app

The domain wailing-vegetable-low.on-fleek.app was registered on February 21, 2026 through the registrar 1API GmbH. Its sub‑domain structure and the “on‑fleek.app” suffix indicate use of a hosted web‑application platform. The site explicitly imitates the MetaMask brand, as evidenced by the page title “Claim $MASK Token | MetaMask” and the visual cues that typically accompany MetaMask token‑claim portals.

Infrastructure analysis shows the domain resolves to IP address 104.26.12.141, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are riha​na.ns.cloudflare.com and scott.ns.cloudflare.com, confirming the Cloudflare front‑end. The site serves HTTPS with an SSL certificate rated E5 and returns an HTTP 301 redirect to the same host, indicating a static landing page rather than dynamic content.

VirusTotal currently reports 14 out of 95 security vendors flagging the domain, reflecting a moderate detection rate for malicious behavior. The domain is already listed on three public blocklists, including PhishDestroy, ScamSniffer, and PhishingDB, and its status remains active as of the report date. No additional payloads, command‑and‑control endpoints, or credential‑harvesting forms have been observed beyond the token‑claim page, leaving the full extent of the campaign’s infrastructure uncertain.

Defenders should immediately block DNS resolution for wailing-vegetable-low.on-fleek.app and any subdomains under the on‑fleek.app namespace that reference MetaMask. Network sensors should monitor outbound traffic to the Cloudflare IP 104.26.12.141 for suspicious request patterns. Users of the MetaMask wallet should be warned not to enter private keys or seed phrases on any site presenting token‑claim offers, and incident response teams should log any attempted accesses for further attribution.