metasmask[.]io

Analysis of metasmask.io confirms it as an active phishing domain targeting MetaMask cryptocurrency wallet users. The domain was registered on March 9, 2026, through Dynadot Inc and currently resolves to IP address 185.66.140.182. As of July 29, 2026, five out of ninety-one security vendors on VirusTotal have flagged this domain, indicating detection by a minority of engines but sufficient to warrant elevated risk classification. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and MetaMask's own internal systems, confirming its malicious intent.

Infrastructure analysis reveals the domain uses nameservers ns13.knownsrv.com and ns14.knownsrv.com, a hosting pattern observed in other phishing campaigns. The IP address 185.66.140.182 has not been linked to additional malicious domains in the current dataset, but its association with this confirmed phishing site suggests it may be part of a broader malicious hosting infrastructure. No SSL certificate details, HTTP response status, or page content analysis are available at this time, limiting further assessment of the phishing kit or specific attack vectors employed.

Defenders should treat metasmask.io as a confirmed threat and implement immediate blocking at the DNS, network, and endpoint levels. MetaMask users should be alerted to avoid interacting with this domain, and security teams should monitor for related domains using the same nameservers or IP range. Given the domain's registration date and active status, this campaign may persist or evolve, requiring ongoing vigilance.