metamask[.]ci

This domain, metamask.ci, was registered on 21 February 2026 and is currently offline. The single page that was observed returned the title string "metamask.ci". The site was classified as a crypto‑related brand impersonation, explicitly targeting the MetaMask wallet application. Infrastructure analysis shows the domain resolves to IP address 167.160.161.207, which is geolocated to the United States and is associated with Virtualine Technologies.

The domain has been referenced in five AlienVault OTX threat‑intelligence pulses, indicating that the community has identified it as part of a broader campaign. VirusTotal scans reported fifteen of ninety‑three antivirus engines flagging the domain as malicious, confirming the presence of detectable payloads or malicious behavior. The domain appears on at least one public security blocklist and has been actively blocked by the PhishDestroy mitigation platform. No further data on SSL configuration, HTTP response codes, registrar information, or additional detection vendor scores were provided, so the completeness of the threat profile remains limited to the observed indicators.

Defenders should add 167.160.161.207 to network‑level deny lists, ensure that any allow‑list entries for MetaMask‑related URLs are scoped to legitimate domains, and monitor for new domains that mimic the "metamask" brand. Continuous ingestion of OTX pulse updates and VirusTotal feeds will help capture any re‑appearance of the infrastructure. Because the site is offline, immediate risk is reduced, but the underlying infrastructure could be repurposed; therefore, ongoing vigilance is advised.