mfmskkvjsnnsnajprroon[.]cc

This domain, mfmskkvjsnnsnajprroon.cc, is flagged as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the domain is designed to deceive users into entering sensitive credentials, likely through a cloned interface, enabling attackers to drain digital assets from compromised wallets. The infrastructure and naming pattern suggest the use of a wallet-draining kit, though no specific kit variant has been conclusively attributed at this time. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 156.239.229.165, hosted on AS154321 (CORENET CLOUD SDN. BHD.) in Hong Kong. It was registered on April 15, 2026, through NameSilo, LLC, and secured with a Let's Encrypt SSL certificate (R13). VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by at least three threat intelligence feeds, including MetaMask’s internal systems. As of the latest assessment, mfmskkvjsnnsnajprroon.cc remains active, posing an ongoing risk to users who may encounter it through phishing campaigns, malicious advertisements, or compromised links. Response actions include continued monitoring, domain takedown requests, and dissemination of indicators to security communities. Despite these efforts, the domain’s persistence and low detection rate (2/95) indicate a residual risk, particularly for users who bypass browser or endpoint protections. Users are advised to verify domain authenticity before entering credentials and to inspect SSL certificates for anomalies. Wallet holders should enable hardware-based authentication and monitor transaction logs for unauthorized activity.