metamaskwalllet[.]ukit[.]me

This domain, metamaskwalllet.ukit.me, is actively impersonating the MetaMask brand as of July 12, 2026. Analysis indicates a high-risk phishing infrastructure targeting users of the MetaMask cryptocurrency wallet service. The domain was registered on December 12, 2016, and currently resolves to the IP address 185.129.100.126. It appears on two security blocklists and is flagged by six out of ninety-five security vendors on VirusTotal, suggesting a moderate level of detection but not yet widespread awareness. Infrastructure analysis reveals the use of Node.js, Bootstrap, RequireJS, and Express for backend and frontend development, alongside Yandex.Metrika and Google Analytics for tracking user interactions. The presence of DDoS-Guard suggests an attempt to protect the site from takedown efforts or disruption. The SSL certificate is issued by GoGetSSL, a common choice for both legitimate and malicious sites. The page title, 'uKit — Website's trial period has expired,' does not directly indicate phishing content, but this may reflect a placeholder or obfuscation tactic rather than the actual malicious page served to victims. The domain is registered through the Regional Network Information Center, JSC (RU-CENTER), and remains active despite its detection on blocklists such as PhishDestroy and Enkrypt. Defenders should treat this domain as a confirmed brand impersonation threat. Network-level blocking of 185.129.100.126 and the domain itself is recommended, along with monitoring for related subdomains or IPs that may emerge as part of the same campaign. The exact content served to users is not yet analysed, but the combination of brand impersonation, tracking technologies, and security vendor detections warrants immediate action to mitigate potential credential theft or cryptocurrency fraud.