helpmetamask[.]net

On July 22, 2026, helpmetamask.net was identified as a domain impersonating MetaMask, a popular cryptocurrency wallet. The domain was taken offline, but prior to that, it was flagged by 4 out of 95 security vendors on VirusTotal, indicating some level of suspicion. The domain appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL, further suggesting its malicious nature. The domain was registered through HOSTINGER operations, UAB, and its nameservers are ns1.dns-parking.com and ns2.dns-parking.com.

At the time of assessment, the page title was 'Parked Domain name on Hostinger DNS system,' which could indicate that the domain was not actively being used for malicious purposes when it was taken offline. However, the domain resolves to the IP address 84.32.84.32, which is located in Lithuania and is part of the AS47583 Hostinger International Limited network. The lack of an SSL certificate and the presence of flags from multiple security vendors and blocklists suggest that the domain was likely involved in a crypto scam.

Defenders should treat this domain with caution and ensure it remains blocked in their security systems to prevent any potential access by users. While the domain is currently offline, the infrastructure and registration details indicate a deliberate attempt to impersonate MetaMask, and there is a risk that it could be reactivated for malicious purposes in the future. Regular monitoring and updates to blocklists are recommended to maintain security.