learn-metamaskio-sso[.]wstd[.]io

Analysis of learn-metamaskio-sso.wstd.io indicates that the domain was registered on 21 February 2026 through NameCheap, Inc. The authoritative name servers are sandra.ns.cloudflare.com and cosmin.ns.cloudflare.com, pointing to Cloudflare’s network. DNS resolution returns the IP address 104.19.164.34, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8), but HTTP requests receive a 401 Unauthorized response, suggesting that the front‑end is either protected or has been taken offline. The domain is classified as a crypto‑scam that impersonates the MetaMask brand; Google Safe Browsing flags it for social engineering, and 11 of 95 security vendors on VirusTotal have reported it as malicious.

It appears on one external blocklist and has been actively blocked by the PhishDestroy sinkhole. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current operational status is offline, and no additional content or page‑title information has been captured. Uncertainties remain regarding the specific payload used, as no sandbox or static analysis data are available.

The 401 response prevents direct observation of the landing page, and the lack of public screenshots limits confirmation of the exact user‑experience flow. Defenders should continue to block the domain and its associated IP at perimeter defenses, update URL filtering and threat‑intel feeds with the observed indicators (domain, IP, nameservers, SSL fingerprint), and monitor for any re‑registration attempts or related sub‑domains that may reuse the same Cloudflare infrastructure. Ongoing vigilance is recommended because the infrastructure—particularly the Cloudflare edge—can be repurposed for future impersonation campaigns targeting MetaMask users.