uat[.]extension-metamask-wallet[.]com

The domain uat.extension-metamask-wallet.com has been identified as a brand impersonation threat specifically targeting MetaMask users. This domain is currently offline, but while active it operated as a crypto drainer, attempting to steal cryptocurrency wallets and credentials from unsuspecting visitors. The page title was simply the domain name itself, indicating a hastily constructed phishing page. The threat level is elevated due to the high value of the MetaMask brand and the potential for financial loss.

Technical analysis reveals that this domain was created on July 22, 2025, and registered through Hosting Concepts B.V. d/b/a Registrar.eu. It resolved to IP address 15.197.130.221 and had no SSL certificate, a common red flag for fraudulent sites. VirusTotal flagged the domain with 14 out of 95 security vendors marking it as malicious, and it appeared on one security blocklist. These indicators collectively confirm the malicious intent behind the domain.

As the domain is now offline, the immediate risk is reduced, but users should remain vigilant against similar domains. PhishDestroy recommends that users always verify the legitimacy of any site claiming to be MetaMask by checking the official URL directly. Avoid clicking on links in unsolicited messages or emails. If you have interacted with this domain, change your MetaMask passwords and revoke any permissions granted. Report any suspicious domains to PhishDestroy for further analysis.