io-verification-support[.]sbs

The domain io-verification-support.sbs was registered on 21 February 2026 and is presently offline. Its sole public page advertises a “MetaMask Security Verification” title, directly referencing the MetaMask brand, which aligns with the intelligence that the site impersonates MetaMask in a crypto‑scam context. DNS resolution points to the IPv6 address 2606:4700:3032::ac43:ba3c, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The use of a Cloudflare front‑end is common among malicious operators seeking to hide origin infrastructure while leveraging the provider’s global edge network.

Security‑vendor scanning on VirusTotal returned 12 positive detections out of 93 scanners, indicating that multiple anti‑malware and URL‑reputation services have identified the domain as malicious. The domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the assessment of elevated risk. The SSL certificate presented is labeled “WE1”, a generic certificate that does not provide extended validation and offers no cryptographic assurance beyond basic transport encryption. Evidence gaps remain: no Safe Browsing, Open Threat Exchange, or registrar‑level reputation data were supplied, and no explicit threat‑intel feeds (e.g., OTX signatures) were linked to the domain.

Consequently, while the available indicators strongly point to a brand‑impersonation crypto scam, the full scope of the campaign—such as malicious payloads, phishing forms, or secondary infrastructure—cannot be confirmed without live site analysis. Defenders should continue to block the domain at perimeter filters, update URL‑reputation databases with the observed detections, and monitor for any new subdomains or IP addresses that resolve to the same Cloudflare ASN.