supportmetamask[.]biz

supportmetamask.biz is currently classified as an active crypto drainer with an elevated risk rating. The domain was registered on 18 August 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 81.181.67.12. Multiple industry‑wide blocklists have already listed the domain; it is present on three security blocklists and has been specifically blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that six of ninety‑one scanning engines flag the domain as malicious, reinforcing the classification.

The infrastructure indicates a single‑host setup, with no additional C‑NAME or CDN layers observed in the public DNS resolution. No SSL certificate details, HTTP response codes, or page title information are presently available, limiting a deeper content‑based assessment. Defenders should immediately add 81.181.67.12 to network deny lists and enforce DNS filtering for supportmetamask.biz. Continuous monitoring of outbound connections to this address is recommended, as is the inclusion of the domain in endpoint protection allow‑list exclusions for false‑positive mitigation.

Because the domain targets MetaMask users, organizations that handle cryptocurrency wallets should apply stricter web‑traffic controls around wallet‑related URLs and consider sandboxing any user‑initiated connections to the domain. Threat intelligence feeds should be updated to reflect the current detection status, and any observed attempts to resolve or contact the domain should be logged for incident response. Until further forensic details—such as TLS fingerprints or server banners—become available, the precautionary stance should remain elevated, treating any interaction with supportmetamask.biz as potentially compromising.