metamark[.]world

metamark.world is an active generic phishing site first observed on May 20, 2026. The site presents a counterfeit interface that mimics MetaMask, aiming to harvest cryptocurrency wallet credentials. Its risk rating is high and the infrastructure remains reachable as of July 12, 2026. The domain is registered through GoDaddy.com, LLC and uses the authoritative name servers ns3.afternic.com and ns4.afternic.com. It resolves to the IP address 13.248.169.48, which belongs to an AWS Global Accelerator endpoint located in Canada. The TLS certificate is a GoDaddy Secure Certificate Authority – G2 issued by GoDaddy.com, Inc., and the web server returns HTTP 200 responses, indicating a fully operational front‑end. Independent scoring systems assign a Gridinsoft trust score of 0 out of 100, and the domain appears on two public blocklists. Threat intelligence feeds have flagged the site. PhishDestroy and MetaMask’s own blocklists already list the domain, and VirusTotal records two detections out of ninety‑five security engines, confirming that at least some scanners consider the site malicious. The low trust score combined with the presence on multiple blocklists suggests an active credential‑stealing campaign rather than a dormant test site. Defenders should add 13.248.169.48 and metamark.world to network deny lists, enforce URL filtering for known MetaMask domains, and monitor DNS queries for the afternic name servers. End‑user education should emphasize verification of MetaMask URLs and caution against unsolicited login prompts. Continuous re‑assessment is advised, as the infrastructure could shift to new IP ranges or certificate authorities while maintaining the same deceptive branding.