metamask[.]eth[.]ec[.]cc

This domain, metamask.eth.ec.cc, is actively engaged in brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the domain is designed to deceive users into believing they are interacting with legitimate MetaMask infrastructure, potentially facilitating credential theft or unauthorized transactions. The domain remains operational as of the latest assessment. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. and resolves to the IP address 102.134.35.21, located in Taiwan under Telkom SA Ltd. The domain was created on May 18, 2026, an anomalous future date suggesting potential manipulation or misconfiguration. It is flagged by 2 of 95 security vendors on VirusTotal and appears on three independent security blocklists. The SSL certificate is issued by Let's Encrypt (R12), a common but non-exclusive indicator of legitimacy, often exploited in phishing campaigns. The page title, 'Web3 Gateway,' further aligns with terminology used in cryptocurrency-related fraud. Current status confirms the domain remains active, posing an ongoing threat to users. Recommendations include immediate blacklisting of the domain and associated IP address (102.134.35.21) within network security controls. Organizations should update endpoint protection rules to block access and monitor for connections to this infrastructure. Users should be educated to verify domain authenticity before entering credentials or connecting wallets, particularly for domains mimicking trusted brands. Continuous monitoring of newly registered domains with similar naming patterns is advised to preempt further impersonation attempts.