metamdsk[.]io

Analysis of metamdsk.io indicates that the domain is being used to impersonate the MetaMask cryptocurrency wallet, targeting users with wallet or seed phishing attempts. The domain was registered on November 10, 2025 through Web Commerce Communications Limited and resolves to the IP address 172.67.136.6, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Cloudflare is also the provider of the domain's DNS infrastructure, as evidenced by the authoritative nameservers anirban.ns.cloudflare.com and cass.ns.cloudflare.com. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 identifier, confirming the use of a trusted TLS chain despite the malicious intent.

HTTP requests to the host return a 403 status code, suggesting that the server is configured to deny direct access, which is a common tactic for phishing pages that rely on content delivery via redirects or client‑side scripts. VirusTotal scans have flagged the domain in 17 of 95 security vendors, providing multi‑engine corroboration of its malicious nature. The domain is listed on a security blocklist and has been explicitly blocked by PhishDestroy, reinforcing the consensus that it should be treated as hostile.

No Safe Browsing, OTX, or page‑title information is available, and the exact content of the site has not been captured, leaving the visual and functional specifics of the phishing page unverified. Given the confirmed indicators—Cloudflare‑hosted infrastructure, a Google‑issued TLS certificate, multiple vendor detections, blocklist presence, and its classification as a wallet/seed phishing operation—defenders should immediately add metamdsk.io to network and email deny lists, monitor DNS query logs for look‑ups to the domain or its IP, and consider implementing egress filtering that blocks traffic to Cloudflare‑owned IP ranges associated with newly registered domains.