verify-walletmetamask[.]ddnss[.]eu

This domain, verify-walletmetamask.ddnss.eu, was identified as a MetaMask impersonation campaign targeting cryptocurrency users. The site was hosted under the ddnss.eu sub‑domain service and resolved to the IP address 23.95.218.212, which belongs to AS36352 (HostPapa) located in the United States. Registration was performed through InterNetX GmbH, and the domain uses the ns1.ddnss.de and ns2.ddnss.de nameservers. VirusTotal records show that 10 of 93 scanned security engines flag the domain as malicious, and it appears on at least one public blocklist.

Gridinsoft assigned a trust score of 0 out of 100, and the page title returned by the server is "Increase Conversions & Site Growth – Zeus Bangs", a title unrelated to MetaMask. No TLS certificate was presented, confirming the absence of HTTPS protection. The site has been taken offline and is currently blocked by the PhishDestroy sinkhole. The available evidence points to a crypto‑scam kit that leverages brand impersonation to lure victims into providing wallet credentials.

Uncertainty remains around the exact phishing page structure, any credential‑stealing forms, and whether additional infrastructure such as command‑and‑control servers is tied to the same IP range. Defenders should add the domain and its IP address to deny lists, monitor DNS queries to the ddnss.de nameservers, and enforce outbound filtering for traffic to HostPapa‑hosted addresses. Ongoing monitoring of threat‑intel feeds for new variants reusing the same registration pattern or page title is recommended.