wallet[.]web-metamask[.]to

This domain, wallet.web-metamask.to, is identified as a high-risk brand impersonation resource targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site replicates the legitimate MetaMask interface under the page title 'MetaMask: Secure Wallet Solution for Crypto Enthusiasts,' a common tactic to deceive users into disclosing wallet credentials or seed phrases. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns designed to facilitate unauthorized access to digital assets. Infrastructure analysis reveals the domain was registered on April 15, 2026, through the Government of Kingdom of Tonga registrar, an uncommon choice for legitimate services. It resolves to the IP address 178.16.53.99, hosted by Omegatech LTD in the Netherlands. Detection metrics show the domain is flagged by 20 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. Additionally, the domain has been explicitly blocked by multiple threat intelligence platforms, including MetaMask’s internal systems and sector-specific monitoring initiatives. As of the latest assessment, wallet.web-metamask.to has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the underlying infrastructure may persist, and similar domains could emerge using comparable registration patterns or hosting providers. Users are advised to verify domain authenticity through official channels before interacting with any cryptocurrency service. Organizations should monitor for related indicators, including the IP address 178.16.53.99 and domains registered via the Tonga government registrar, to preemptively block potential impersonation attempts.