metmask-io[.]netlify[.]app

Analysis indicates that the domain metmask-io.netlify.app is currently offline, returning a 404 “Site not found” response. The host resolves to the Amazon Web Services IP address 35.157.26.135, which is registered to AS16509 in Germany. The SSL certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, consistent with Netlify‑hosted sites and confirming the use of HTTPS with HSTS enabled. Netlify is identified as the hosting platform, and the domain’s authoritative nameserver data is unavailable (NS_NOT_FOUND). The site is flagged by PhishDestroy and appears on a single external blocklist, confirming that it has been recognized as malicious by at least one trusted sink.

VirusTotal scans show that 13 of 95 security engines label the domain as malicious, reinforcing the suspicion. The page title returned is “Site not found,” and no additional content has been captured, indicating that the phishing landing page has been removed or taken down. The domain is explicitly associated with MetaMask brand impersonation and categorized as wallet/seed phishing, suggesting that any prior iteration likely attempted to harvest cryptocurrency wallet recovery phrases or private keys. No evidence of active phishing content is presently observable, but the infrastructure – AWS hosting, Netlify deployment, and a valid DigiCert certificate – demonstrates that attackers can acquire trusted TLS credentials to increase credibility.

Defenders should continue to block the IP 35.157.26.135 and add metmask-io.netlify.app to internal deny lists. Monitoring of Netlify‑hosted subdomains for similar naming patterns (e.g., “metmask-…”) is recommended, as the platform can be leveraged to spin up short‑lived phishing sites. Users of MetaMask should be reminded that legitimate MetaMask communications never request seed phrases via web links, and any unsolicited request should be treated as fraudulent.