metamask[.]to

This domain, metamask.to, was registered on May 19, 2026 and is currently active. It is classified as a high‑risk brand‑impersonation campaign targeting the MetaMask wallet service. The domain resolves to the IP address 13.248.169.48, which is hosted in Canada behind an AWS Global Accelerator endpoint. An SSL certificate issued by GoDaddy (GoDaddy TLS Intermediate CA DV - R1v1) is present, indicating a valid TLS handshake despite the malicious intent. The registration was performed through Namecheap and the authoritative name servers are ns1.afternic.com and ns2.afternic.com. Reputation data shows a Gridinsoft trust score of 0 out of 100 and the domain appears on two security blocklists. It has been flagged by PhishDestroy and SEAL, and a single AlienVault OTX pulse references it. VirusTotal analysis reports that 2 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious use. Publicly available evidence does not reveal the exact content delivered at the URL; the HTTP response code is 200, but the page’s payload has not been captured in the shared intelligence. Consequently, the specific phishing kit, credential‑harvesting forms, or any redirect behavior remain unknown. The lack of detailed payload information limits the ability to attribute the campaign to a known actor or to assess the full scope of the threat. Defenders should add 13.248.169.48 and the hostname metamask.to to network blocklists and enforce URL filtering for any requests to this domain. Continuous monitoring of DNS queries for the Afternic name servers can provide early warning of additional look‑alike registrations. End‑user awareness training should emphasize that legitimate MetaMask communications never originate from a .to TLD and that TLS certificates issued by GoDaddy do not guarantee authenticity. Incident response teams should capture the page content on first sight to enrich detection signatures and share findings with threat‑intel communities.