metamaskhelp[.]pro

Analysis of the domain metamaskhelp.pro indicates a confirmed crypto scam impersonating MetaMask, classified as brand impersonation with an elevated risk level. The domain was registered on March 3, 2026, through HOSTINGER operations, UAB, and resolved to the IP address 2.57.91.91, hosted under AS47583 (Hostinger International Limited) in Cyprus. Nameservers ns1.dns-parking.com and ns2.dns-parking.com were assigned, and no SSL certificate was detected. The domain's page title, 'Parked Domain name on Hostinger DNS system,' suggests it was either inactive or misconfigured at the time of assessment, though this does not diminish its malicious intent.

Detection data reveals limited but actionable intelligence: one of ninety-three security vendors on VirusTotal flagged the domain, and it appears on three security blocklists, including PhishDestroy, MetaMask's internal systems, and SEAL. The domain has since been taken offline, reducing immediate exposure, but residual risks remain for users who may have interacted with it prior to deactivation. Infrastructure analysis shows no association with MetaMask's legitimate infrastructure, reinforcing its fraudulent nature. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels.

Security teams are advised to review logs for connections to 2.57.91.91 or references to metamaskhelp.pro, particularly in environments where MetaMask or cryptocurrency-related activities are common. Given the domain's registration recency and hosting on a provider frequently used for phishing campaigns, monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended. No evidence of active exploitation post-takedown has been confirmed, but retrospective analysis of endpoint and proxy logs may identify prior compromise attempts.