metamnask[.]io

Analysis conducted on 29 July 2026 confirms that the domain metamnask.io is actively leveraged for phishing. The domain was registered through Dynadot Inc on 9 March 2026 and currently resolves to the IPv4 address 185.66.140.182. Authority for the zone is provided by the nameservers ns13.knownsrv.com and ns14.knownsrv.com. Reputation data indicate placement on two public security blocklists, with explicit blocks reported by PhishDestroy and MetaMask.

VirusTotal scans show that five of ninety‑one security vendors have flagged the domain as malicious, reinforcing the suspicion of illicit activity. Infrastructure analysis reveals no publicly disclosed SSL certificate details, HTTP response codes, or Safe Browsing verdicts for the domain, and no Open Threat Exchange (OTX) entries were found at the time of assessment. Consequently, confidence in the domain’s malicious intent relies primarily on the observed blocklist entries, registrar information, and the modest VirusTotal detection count.

Defenders should incorporate metamnask.io into URL filtering policies, add the associated IP address 185.66.140.182 to network‑level deny lists, and ensure that the nameservers ns13.knownsrv.com and ns14.knownsrv.com are monitored for any changes that could signal further malicious hosting. Continuous re‑scanning with multi‑vendor services is advised to capture any escalation in detection rates. Given the early creation date and the current active status, proactive blocking is recommended to mitigate potential credential harvesting attempts.