metamasklogink[.]blogspot[.]mk

On 22 July 2026 the domain metamasklogink.blogspot.mk was observed hosting a credential‑stealing page that claims to show how to recover a MetaMask wallet without the private key. The page title is exactly “How to recover MetaMask Wallet without the private key?”. The site resolves to the IPv4 address 142.251.13.132, which belongs to Google LLC and is located in the United States. TLS termination is provided by Google Trust Services under the WE2 certificate, indicating the use of Google’s public‑key infrastructure. An HTTP 302 response is returned for the initial request, and the site runs on Blogger infrastructure with additional components identified as Java, Python, OpenGSE, Clipboard.js and HTTP/3.

The domain was registered through UNET-REG; the authoritative nameservers could not be resolved (NS_NOT_FOUND). VirusTotal analyses returned 14 positive detections out of 91 scanned scanners, confirming that multiple security vendors classify the domain as malicious. The domain is presently listed on three external blocklists and is actively blocked by PhishDestroy, MetaMask’s own protection service, and SEAL. The threat profile is recorded as a brand‑impersonation campaign targeting MetaMask and is categorized as a crypto drainer.

The current operational status is active and the risk level is high. Defenders should add the IP address 142.251.13.132 and the fully qualified domain name to URL filtering and DNS blocklists, monitor for any related traffic to Google‑hosted Blogger endpoints, and enforce multi‑factor authentication for MetaMask accounts to mitigate credential compromise. Because the nameserver data is missing, further registrar‑level investigation may reveal additional infrastructure. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolution of the payload.