link-metamask[.]io

This domain, link-metamask.io, is an active threat infrastructure designed to impersonate the MetaMask cryptocurrency wallet service. Analysis indicates it functions as a crypto drainer, a type of malicious site engineered to trick users into connecting their wallets, granting permissions that allow attackers to siphon digital assets without authorization. The site mimics legitimate MetaMask branding, including the page title and visual design, to deceive users into believing they are interacting with the official platform. Once wallet access is granted, funds can be drained instantly, often irreversibly due to the nature of blockchain transactions. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered on May 15, 2026, through NameSilo, LLC, a registrar frequently observed in phishing operations. It resolves to the IP address 80.96.113.128, hosted by AlexHost SRL in Romania, a provider commonly associated with bulletproof hosting services. The domain is secured with a Let's Encrypt SSL certificate, a tactic used to lend false legitimacy to the site. VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The domain remains active and unmitigated at the time of this report. Users who have visited link-metamask.io or interacted with it should take immediate action to secure their assets. First, revoke any wallet permissions granted to the domain using a trusted blockchain explorer or wallet management tool. Next, transfer remaining funds to a new, secure wallet address not previously exposed to the malicious site. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams or community alert platforms. Due to the irreversible nature of cryptocurrency transactions, prevention and rapid response are critical to mitigating financial loss.