metam[.]ask[.]io

The domain metam.ask.io is a cryptocurrency phishing site engaged in brand impersonation targeting MetaMask users. It posed as a legitimate MetaMask service to deceive victims into disclosing wallet credentials or sensitive information, though no drainer kit was identified. As of the latest verification, metam.ask.io has been taken offline and is no longer accessible.

Technical indicators confirm the elevated risk level. The domain was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and alphaMountain.ai, and appears on 1 security blocklist (PhishDestroy). It was registered through Spaceship, Inc. on March 27, 2013, and resolved to the IP address 3.12.48.78, hosted on Amazon.com, Inc. (AS16509) in the US. No SSL certificate was available, and the observed page title was 'Sell domains for 8% commission only. : DomainHunt.com'. The domain uses nameservers launch1.spaceship.net and launch2.spaceship.net and returned an HTTP 502 status when accessed.

Victims of metam.ask.io should immediately revoke any token approvals granted to suspicious contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to MetaMask’s official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.