metaranch[.]github[.]io

This domain, metaranch.github.io, poses a significant brand impersonation threat, specifically targeting users of MetaMask. The domain is designed to trick users into believing it is an official or legitimate source for downloading the MetaMask extension, which could lead to the installation of a malicious version of the extension or other harmful actions.

Analysis indicates that the domain is flagged by 17 out of 95 security vendors on VirusTotal, highlighting the potential risk associated with it. The domain was created on February 21, 2026, and is currently hosted on an IP address (185.199.110.153) located in the United States, under the autonomous system AS54113, operated by Fastly, Inc. The domain is registered through MarkMonitor, Inc., and is secured with an SSL certificate issued by Let's Encrypt. Google Safe Browsing has flagged this domain as phishing, and it appears on three security blocklists, including PhishDestroy and SEAL. These indicators suggest that the domain is actively being used for malicious purposes and is recognized by multiple security platforms.

If users have visited this domain, they are advised to immediately verify their MetaMask extension and ensure it was downloaded from the official MetaMask website or verified app stores. Users should also monitor their accounts for any unauthorized activity and consider changing their passwords and enabling two-factor authentication. It is recommended to run a full system scan using updated antivirus software and to report the incident to their security team or organization for further investigation and potential action.