inlogin[.]metamask[.]skyliteconsulting[.]com

The domain inlogin.metamask.skyliteconsulting.com was registered on June 08, 2026 and is currently classified as an active high‑risk brand‑impersonation campaign targeting MetaMask users. Multiple security blocklists have added the domain, and three independent blocklist providers—PhishDestroy, MetaMask’s own protection service, and SEAL—have confirmed it as malicious. VirusTotal scans show that 16 of 91 AV engines flag the host, indicating a consensus of malicious behavior across a subset of scanners. Analysis indicates that the domain is being used to masquerade as a MetaMask login portal, as reflected in the brand target field.

No public page title or HTTP response details have been disclosed, and infrastructure data such as IP address, ASN, or SSL certificate information has not been published in the available intelligence. Consequently, the exact hosting location and transport security posture remain unknown. Defenders should immediately block any DNS resolution to inlogin.metamask.skyliteconsulting.com at network perimeter devices and add the domain to local deny lists.

Email security gateways should treat messages containing this URL as malicious and quarantine them. End‑users should be warned that any unsolicited request to log in to MetaMask via a URL containing “inlogin.metamask” is likely fraudulent. Continuous monitoring of VirusTotal, open‑source threat feeds, and the listed blocklists is advised to capture any changes in detection coverage or additional indicators.