securemymetamaskwallet[.]run[.]place

The domain securemymetamaskwallet.run.place was registered on February 21, 2026 through Netdorm, Inc. dba DnsExit.com and resolved to the IPv4 address 45.159.189.35, which is announced by AS14576 Hosting Solution Ltd. in the Netherlands. The authoritative name servers listed for the zone are ns10.dnsexit.com, ns11.dnsexit.com, ns12.dnsexit.com, and ns13.dnsexit.com. A TLS certificate issued by Let’s Encrypt (R13) was observed, indicating that the site employed HTTPS at the time of analysis. The page title returned by the service was "EMPLOYEE'S HANDBOOK NEW GUIDELINE | Human Resource," and the threat was classified as a crypto scam that impersonates the MetaMask brand.

The domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer, reinforcing the suspicion of malicious intent. VirusTotal scans recorded 15 detections out of 93 security vendors, providing additional corroboration that the site was flagged by a substantial portion of the scanning ecosystem. As of the report date, July 23, 2026, the site is listed as offline, preventing direct observation of the payload or login interface.

However, the combination of brand impersonation, a misleading corporate‑style page title, and the detection profile strongly suggests a credential‑harvesting or fund‑misappropriation campaign targeting MetaMask users. Defenders should proactively block the domain and its associated IP address at network perimeter devices, incorporate the observed name servers into DNS filtering policies, and monitor for future registrations that reuse the same registrar or hosting ASN. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and incident response teams should be prepared to advise users to verify MetaMask URLs against known official endpoints.