metamskwallet[.]boxmode[.]io

The domain metamskwallet.boxmode.io is identified as a high-risk phishing infrastructure specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet. Analysis confirms this as a brand impersonation threat, targeting users seeking access to Ethereum-based services. The domain is currently offline, but prior activity indicates malicious intent to harvest credentials or facilitate crypto asset theft. Infrastructure analysis reveals the domain was created on July 29, 2019, and registered through URL SOLUTIONS INC. It resolved to the IP address 209.192.137.208, hosted on AS7979 (Servers.com, Inc.) in the United States. Security vendors flagged the domain aggressively, with 20 out of 95 VirusTotal engines detecting it as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was explicitly labeled as phishing by Google Safe Browsing. The SSL certificate was issued by Let's Encrypt (R12), a common tactic to lend false legitimacy to phishing pages. The page title, 'MetaMask Wallet - A direct gateway to Ethereum blockchain,' closely mimics official MetaMask branding to deceive users. While the domain is currently offline, historical data suggests it was part of an active phishing campaign. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who interacted with the site should assume credential compromise and immediately revoke access to any linked crypto wallets or accounts. Monitoring for similar domains using variations of 'metamask' or 'wallet' is recommended, as threat actors frequently reuse infrastructure patterns. Security teams should update detection rules to include the domain, IP, and SSL certificate fingerprint as indicators of compromise.