etamask[.]io

This domain, etamask.io, is identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site is designed to deceive users into disclosing sensitive wallet credentials or private keys, likely through a fraudulent interface mimicking legitimate MetaMask authentication flows. The page title, 'OmniversAI · Create Your Universe,' suggests an attempt to obfuscate the true malicious intent with unrelated branding, a common tactic in phishing campaigns to evade casual detection. Infrastructure analysis reveals the domain was registered on August 16, 2024, through NameSilo, LLC, and resolves to the IP address 185.66.140.182. The site employs a Let's Encrypt SSL certificate, providing a false sense of security to visitors. Detection metrics show the domain is flagged by 3 out of 95 security vendors on VirusTotal and appears on one security blocklist. The server utilizes LiteSpeed technology with HTTP/3 support, indicating a relatively modern hosting setup that may facilitate rapid deployment and evasion of traditional security measures. As of the latest assessment, etamask.io has been marked as taken down, likely following reports to the registrar or hosting provider. However, the elevated risk level persists due to the potential for residual exposure among users who may have interacted with the domain prior to its removal. Security teams are advised to monitor for any re-registration attempts or shifts in hosting infrastructure, as threat actors frequently re-deploy similar domains. Users should verify the authenticity of any MetaMask-related communications and avoid entering credentials on untrusted sites, even if they appear visually identical to legitimate services.