metamask[.]in

metamask.in is a phishing domain engaged in brand impersonation targeting the MetaMask cryptocurrency platform. The site was designed to deceive users by mimicking MetaMask with the intent to scam, although no specific drainer kit was identified. This domain is currently taken offline, reducing immediate risk but remaining a relevant threat due to its prior presence.

Technical indicators reveal that metamask.in was created on September 28, 2024, and is registered through Dynadot LLC. It resolves to the IP address 2606:4700::6810:8d72, located in the US and associated with AS13335 Cloudflare, Inc. The domain uses an SSL certificate issued by DigiCert Inc / Encryption Everywhere DV TLS CA - G2. VirusTotal flags metamask.in by 2 of 95 security vendors, including ChainPatrol and Seclookup. The domain appears on one security blocklist, PhishDestroy, and is referenced in 5 AlienVault OTX threat intelligence pulses. The observed page title was 'metamask.in is available for purchase - Sedo.com'. The domain employs technologies such as Apple iCloud Mail, HSTS, and Cloudflare.

Users who may have encountered metamask.in should consider that this phishing scam involved brand impersonation targeting cryptocurrency users. It is advisable to change any credentials or passwords that might have been entered, enable two-factor authentication where available, and monitor accounts for unauthorized activity. Reporting the domain to security organizations and using blocklists like PhishDestroy can help mitigate further risks. Users should remain cautious and verify the safety of any MetaMask-related sites before interaction.