metamask-wallet[.]ru

This domain, metamask-wallet.ru, is identified as a high-risk phishing infrastructure specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet service. Analysis confirms it operates as a brand impersonation threat, presenting a fraudulent login interface to deceive users into disclosing sensitive credentials or private keys. The domain is currently offline, though prior activity remains a documented risk. Infrastructure analysis reveals the domain was registered on March 28, 2026, through BEGET-RU, a registrar commonly associated with malicious activity in Eastern European threat landscapes. It resolves to the IP address 87.236.16.13, hosted by Beget Ltd in Russia. The domain appears on four security blocklists, including PhishDestroy, ScamSniffer, CryptoFirewall, and Enkrypt. VirusTotal detection metrics indicate 17 of 95 security vendors flag this domain as malicious, with a Let’s Encrypt R12 SSL certificate providing a veneer of legitimacy. The page title, "МетаМаск кошелек — вход в личный кабинет | Официальный сайт на русском языке," explicitly targets Russian-speaking users, mimicking official MetaMask branding to enhance credibility. Current status indicates the domain has been taken offline, though residual risk persists due to potential re-activation or migration to alternative infrastructure. Organizations and users are advised to implement DNS-based blocking for the domain and associated IP address 87.236.16.13. Endpoint protection systems should be updated to include this domain in phishing and brand impersonation detection rules. Users who may have interacted with this domain should revoke any exposed credentials, review wallet transactions for unauthorized activity, and enable multi-factor authentication on all cryptocurrency accounts. Monitoring for similar domains using the "metamask" keyword or Cyrillic character sets is recommended to preempt further phishing attempts.