metamask[.]de

This domain, metamask.de, is flagged for high-risk brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site is designed to deceive users into believing it is the legitimate MetaMask platform, likely aiming to harvest credentials or deploy crypto-draining malware. No specific drainer kit signatures have been identified at this time, but the domain’s structure and hosting patterns align with known impersonation campaigns. Infrastructure analysis reveals the domain was registered on May 20, 2026, and resolves to the IP address 5.9.10.75, hosted by Hetzner in Germany. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is actively blocked by PhishDestroy and MetaMask’s internal systems. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. The page title, 'realtime.at - Domain gecatcht,' suggests the domain may have been repurposed or parked before being weaponized. As of the latest verification, metamask.de remains active, posing an ongoing risk to users who may mistake it for the legitimate MetaMask service. Response actions by security vendors include blocklisting and internal takedown requests, but the domain has not yet been suspended by the registrar. Users are advised to verify domain authenticity before interacting with any cryptocurrency-related sites, particularly those requesting wallet connections or seed phrases. Organizations should update blocklists to include this domain and monitor for related infrastructure.