metamask[.]escae[.]inphb[.]ci

The domain metamask.escae.inphb.ci was identified as a brand‑impersonation infrastructure targeting MetaMask users. The site was hosted on an A2 Hosting server (AS55293) located in the United States and resolved to the IP address 190.92.154.151. Registration details show the domain was created on 30 January 2017 through AFRIREGISTER, and its authoritative nameservers are ns19092154151.a2dns.com and ns19092154152.a2dns.com. The web server employed LiteSpeed with PHP, advertised HTTP/3 support, and enforced HSTS.

TLS termination used a Let’s Encrypt R13 certificate, confirming the presence of encrypted HTTPS traffic at the time the site was active. The page title returned by the server was "Metamask," matching the declared brand target and confirming the intent to mimic the legitimate MetaMask service. Malware and phishing detection services flagged the domain, with 18 of 95 VirusTotal scanners raising alerts, and the site appeared on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

The infrastructure was categorized as a crypto scam, consistent with the MetaMask impersonation vector. The domain has since been taken offline, as indicated by the current status and the block applied by PhishDestroy. Defensive recommendations include adding the domain and its associated IP address to network‑wide blocklists, monitoring the registrar and nameserver records for potential re‑registration, and employing threat‑intel feeds that reference the observed SSL configuration and technology stack. Continuous observation of the AS55293 network for related activity is advised, as adversaries often reuse hosting environments for subsequent campaigns.