metammask[.]io

metammask.io is currently flagged as a generic phishing site targeting users of the MetaMask cryptocurrency wallet. The domain was registered on December 15, 2020 through NameSilo, LLC and is served from the IPv4 address 185.66.140.182. Its authoritative name servers are ns13.knownsrv.com and ns14.knownsrv.com. Independent threat‑intelligence feeds have added the domain to two security blocklists and both PhishDestroy and MetaMask’s own protection lists have marked it as malicious.

VirusTotal analysis shows that six of ninety‑one scanning engines returned a detection, confirming that at least a subset of commercial scanners recognize the site as hostile. The combination of blocklist presence, vendor detections, and explicit blocklist entries indicates that the domain is actively being used in phishing campaigns. No public information is available regarding the site’s SSL certificate, HTTP response code, or page title, and automated crawlers have not published a detailed page fingerprint. Consequently, the exact content and lure mechanisms remain unknown, but the consistent attribution to a generic phishing campaign suggests the site likely hosts credential‑stealing pages aimed at MetaMask users.

Defenders should add 185.66.140.182 to network‑level deny lists, block resolution of metammask.io at DNS sinks, and ensure that endpoint security products are updated to reflect the six VirusTotal detections. Continuous monitoring of the two known nameservers is advised, as future sub‑domains may be introduced under the same infrastructure. Organizations that rely on MetaMask should educate users about unsolicited login prompts and enforce multi‑factor authentication where possible. Because the domain was created in 2020 and remains active in 2026, it demonstrates a long‑term operational infrastructure that may be leveraged for additional fraudulent campaigns.