nmetamask[.]io

Analysis of nmetamask.io shows it is actively used as a crypto drainer. The domain was registered on March 09, 2026 through Dynadot Inc and currently resolves to the IPv4 address 185.66.140.182. DNS resolution is served by authoritative name servers ns13.knownsrv.com and ns14.knownsrv.com. The domain appears on two external security blocklists and has been explicitly blocked by the PhishDestroy and MetaMask filtering services, indicating that it is recognized as malicious by both generic phishing and cryptocurrency‑wallet protection tools.

VirusTotal reports that five of ninety‑one scanned scanners flagged the domain, confirming that multiple independent engines have identified malicious characteristics. The elevated risk rating and active status suggest ongoing exploitation. No additional public intelligence such as SSL certificate details, HTTP response codes, or page‑title metadata is available in the supplied data, leaving the exact payload delivery method and victim interaction flow unconfirmed. Defenders should continue to block nmetamask.io at network perimeter and DNS layers, enforce the blocklists that already list the domain, and ensure that endpoint protection solutions incorporate the latest signatures that include the five detecting engines.

Monitoring for new DNS queries to the listed IP address and for any traffic to the known name servers is advisable, as changes in hosting could indicate a shift in infrastructure. Organizations using MetaMask or similar wallet extensions should verify that users are not prompted to connect to this domain and should educate users about the risk of unsolicited wallet connection requests. Continuous re‑evaluation of the domain’s status is recommended, as further analysis may reveal additional indicators such as malicious scripts, compromised certificates, or phishing page content.