webmail[.]metamaskpayouts[.]io

This report analyzes the domain webmail.metamaskpayouts.io, which was identified as an active threat. The site presents a "Webmail Login" page while impersonating the MetaMask brand, classifying it as a cryptocurrency-targeted scam. The primary threat posed is credential harvesting, where users are deceived into entering login credentials intended for a legitimate MetaMask service, leading to potential cryptocurrency wallet compromise and financial loss.

Technical analysis reveals the domain was created on 2026-02-21 and is hosted on IP address 94.130.140.179, located in Germany and assigned to AS24940 Hetzner Online GmbH. It uses a Let's Encrypt SSL certificate (issuer R13). VirusTotal detections show 6 out of 95 vendors flagged the domain as malicious, with specific flags from ChainPatrol, ESET, Fortinet, Seclookup, and SOCRadar. The domain is listed on one blocklist and holds a DOM risk score of 63.

The domain is currently offline and non-responsive. Despite its inactive status, the risk level remains elevated due to the specific impersonation of a major cryptocurrency brand and the domain's recent creation date. The combination of a high-risk score, multiple vendor flags, and targeted scam type warrants continued monitoring and blocking.