metarapid[.]github[.]io

Analysis of metarapid.github.io shows a domain hosted on GitHub Pages that has been leveraged for a brand‑impersonation campaign targeting MetaMask users. The site resolves to the IP address 185.199.109.153, which belongs to Fastly (AS54113) and is located in the United States. DNS resolution uses the nsone.net and AWS name servers (dns1.p05.nsone.net, dns2.p05.nsone.net, dns3.p05.nsone.net, ns-1622.awsdns-10.co.uk), indicating a multi‑provider configuration typical for GitHub‑hosted content delivered through Fastly’s CDN. The TLS certificate is issued by Let’s Encrypt (R12), confirming that HTTPS is correctly negotiated, but the HTTP response is a 404 status code, suggesting the original page is no longer available. The page title that was captured reads “Download MetaMask Extension for Desktop and Mobile,” directly referencing the MetaMask brand and matching the declared impersonation vector.

Security‑vendor scans on VirusTotal flagged the domain in 13 of 93 engines, providing independent corroboration of malicious intent. The domain appears on one public blocklist and has been actively blocked by PhishDestroy, reinforcing the notion that security communities consider it a threat. The registrar information shows the domain was created on 08 Mar 2013 and is registered through GitHub, Inc., a common pattern for abuse of free hosting services. Detected technologies include Varnish, GitHub Pages, and Fastly, all consistent with the observed infrastructure.

While the content is currently offline, the combination of a brand‑specific title, a high‑confidence detection count, and placement on a phishing blocklist indicates a credible crypto‑scam operation that attempts to lure MetaMask users into downloading a malicious extension. The exact payload or phishing flow cannot be confirmed without a live page, so the full scope of the campaign remains uncertain.