nl-metamask[.]com

This investigation records that the domain nl-metamask.com was registered on February 21, 2026 and is currently taken offline. The site was identified as a crypto‑related brand impersonation campaign targeting MetaMask users. Infrastructure analysis shows the domain resolves to IP address 104.21.8.160, which is hosted by Cloudflare, Inc. (AS13335) in the United States. The TLS certificate presented is identified as WE1, indicating a valid SSL handshake but offering no assurance of legitimacy.

The domain appears on a single security blocklist and is listed by PhishDestroy as a known malicious entry. VirusTotal scans reported that eight out of ninety‑three security engines flagged the domain, reinforcing the suspicion of malicious intent. The combination of brand impersonation, the crypto‑scam classification, and the presence on a blocklist suggests an active attempt to deceive MetaMask users, potentially through credential harvesting or transaction redirection.

Because the site is no longer reachable, live content analysis such as page title or HTML structure could not be gathered, leaving the exact attack vector unconfirmed. Defenders should continue to block the resolved IP address and the domain at DNS and web‑filter layers, monitor for new domains that share similar naming patterns or hosting attributes, and update threat intel feeds with the observed indicators. Ongoing vigilance is recommended, especially for users accessing MetaMask services, to prevent exposure to future impersonation attempts that may reuse the same infrastructure or certificate profile.