metamask[.]ss3[.]app

The domain metamask.ss3.app was registered on 21 February 2026 and is currently offline. DNS resolution points to IP 199.59.243.228, an Amazon.com, Inc. host in the United States (AS16509). The site presented the page title “ss3.app”, which does not contain the targeted brand name. Security telemetry indicates that three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—have flagged the domain. VirusTotal scanned the host and 11 of 93 security vendors reported it as malicious.

Reputation services assign extremely low trust scores: Gridinsoft rates it 0/100, Scamadviser 1/100. The SSL certificate is identified as type R11, without further validation details. The campaign is classified as a crypto scam that impersonates the MetaMask brand. The domain appears on three blocklists, confirming that multiple protection services have observed malicious activity.

Because the site is already taken offline, immediate mitigation is limited to updating local and network‑level blocklists with the domain and its resolved IP address. Defenders should also monitor for any re‑registration attempts or derivative subdomains that reuse the same hosting provider or certificate profile. Continuous observation of the IP range belonging to AS16509 is advisable, as the infrastructure may be repurposed for future campaigns. At present, there is no publicly available evidence of the page’s content beyond the title, and no additional indicators such as payload hashes or command‑and‑control endpoints have been disclosed.