smtp[.]metamaskswiss[.]online

The domain smtp.metamaskswiss.online poses a specific threat as a brand impersonation platform targeting MetaMask, a popular cryptocurrency wallet service. Analysis indicates the domain was designed to deceive users into believing it is an official MetaMask communication channel, likely to harvest sensitive credentials, seed phrases, or private keys. The page title 'LWS Webmail :: Bienvenue à LWS Webmail' suggests an attempt to masquerade as a legitimate webmail interface, potentially as a lure or redirect mechanism. The domain is currently offline, but its prior activity represents a significant risk to cryptocurrency users.

Technical indicators provide concrete evidence of malicious intent. VirusTotal reports 12 out of 95 security vendors flagging this domain as malicious, reflecting broad industry consensus on its threat nature. The domain was registered on October 21, 2025, through LWS dba Ligne Web Services, a registrar that has been associated with phishing infrastructure in the past. It resolves to IP address 193.203.239.121, which may host additional malicious domains. The domain appears on 1 security blocklist, and the Gridinsoft trust score is 0 out of 100, indicating no legitimate reputation. The unique seed 36221b confirms this as a distinct phishing variant.

Users who visited smtp.metamaskswiss.online should immediately change their MetaMask account credentials and enable two-factor authentication if available. They should also revoke any permissions granted to unknown dApps or sites, and transfer funds to a new wallet generated on a clean device. It is advisable to scan the system for malware or keyloggers using updated security software. Users should monitor their cryptocurrency accounts for unauthorized transactions and report any suspicious activity to relevant authorities. No further interaction with the domain or its associated IP is recommended, even though it is currently offline, as it may become active again under a different IP or registrar.