metamaskuk[.]top

The domain metamaskuk.top was registered on September 11, 2025 through Gname.com Pte. Ltd. and is currently listed as offline. DNS resolution points to IP address 104.21.84.40, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The authoritative name servers are javon.ns.cloudflare.com and nora.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate was observed for the site, indicating that HTTPS was not configured at the time of analysis.

The page title returned by the server, "MetaMaskU.K," directly references the targeted brand, MetaMask, and aligns with the reported scam type of a crypto‑related impersonation. The domain has been blocked by the PhishDestroy blocklist and appears on a single additional security blocklist, suggesting that at least one external mitigation source has taken action against it. VirusTotal scans recorded 13 detections out of 95 participating security vendors, providing independent confirmation of malicious intent. The evidence points to a brand‑impersonation campaign aimed at deceiving MetaMask users, likely to harvest cryptocurrency credentials or private keys.

Uncertainty remains regarding the specific phishing kit or payload delivered, as no further page content or network traffic has been captured. Defenders should continue to enforce blocklist rules for the domain, monitor Cloudflare‑originated traffic for similar patterns, and consider updating endpoint and email security policies to flag any communications referencing "MetaMaskU.K" or related URLs. Given the offline status, any active infrastructure may be short‑lived, but the registration window and detection history indicate a recent, targeted attempt that could reappear under a different domain or sub‑domain. Continuous vigilance and rapid blocklist propagation are recommended to mitigate repeat attempts.