metanask[.]com

Analysis of metanask.com confirms its classification as a crypto-focused phishing domain impersonating MetaMask, a well-known cryptocurrency wallet service. The domain was registered on February 21, 2026, through Hello Internet Corp and has since been flagged by 14 of 93 security vendors on VirusTotal, indicating broad detection as malicious. It appears on two security blocklists, PhishDestroy and SEAL, further corroborating its fraudulent nature.

Infrastructure analysis reveals the domain resolved to IP address 87.120.126.210, hosted under AS215730 (H2NEXUS LTD) in Germany, a network segment previously associated with phishing activity. The domain lacks an SSL certificate, a common red flag for fraudulent sites, and currently returns an HTTP 404 status, suggesting it has been taken offline or is no longer actively serving content. The page title, 'MetaMask: Your Gateway to the World of Cryptocurrency,' directly aligns with the impersonated brand, reinforcing the intent to deceive users into believing the site is legitimate.

Nameservers ns100.webnic.cc and ns101.webnic.cc are consistent with infrastructure used by threat actors to rapidly deploy and rotate malicious domains. While the exact content of the site remains unanalyzed due to its offline status, the combination of brand impersonation, blocklist presence, and hosting on a high-risk ASN provides sufficient evidence to classify this as a confirmed crypto scam. Defenders should treat this domain as malicious, block resolutions to 87.120.126.210, and monitor related infrastructure for resurgence or similar impersonation attempts targeting MetaMask or other crypto services.