metanmask[.]io

PhishDestroy identifies metanmask.io as an elevated risk domain engaged in brand impersonation, specifically targeting MetaMask users. This is not a generic phishing attempt but a carefully crafted crypto drainer designed to steal wallet credentials and seed phrases. The domain was created on March 09, 2026, and resolves to IP 185.66.140.182, registered through Dynadot Inc. VirusTotal analysis shows 2 out of 95 security vendors flagging this domain, and it appears on 4 security blocklists, indicating broad recognition of its malicious intent. The page title, "FinAI · Intelligence for Finance," is a deceptive facade meant to lure users into believing they are accessing a legitimate financial intelligence tool. The SSL certificate is issued by Let's Encrypt (R13), which is common for both legitimate and malicious sites, so it should not be considered a sign of safety.

To protect against this brand impersonation threat, users must avoid visiting metanmask.io entirely. Never enter your MetaMask seed phrase, private keys, or any sensitive information on this site. If you have already interacted with it, immediately revoke any token approvals and transfer your assets to a new wallet. Always verify the official MetaMask URL (metamask.io) and bookmark it. Enable two-factor authentication where possible and use hardware wallets for large holdings. PhishDestroy recommends reporting this domain to security communities and blocklist providers to help protect others. Stay vigilant against social engineering tactics that may accompany such scams, such as unsolicited emails or messages urging you to connect your wallet. By following these steps, you can safeguard your digital assets from this crypto drainer and similar threats.