metamssk[.]io

This domain is identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. The site is designed to deceive users into believing they are interacting with legitimate MetaMask infrastructure, potentially leading to unauthorized access to wallet credentials, seed phrases, or direct asset theft through crypto drainer mechanisms. The page title "EmotionAI · The Feeling Machine" does not align with MetaMask’s branding, suggesting an attempt to obscure its true purpose while exploiting trust in the targeted brand. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain metamssk.io was registered on December 15, 2020, through NameSilo, LLC, and resolves to the IP address 185.66.140.182. It is flagged by 6 out of 95 security vendors on VirusTotal, appears on 2 security blocklists, and is actively blocked by MetaMask and other security entities. The site employs LiteSpeed server technology and HTTP/3, with a Let’s Encrypt SSL certificate, which are common in both legitimate and malicious infrastructure but do not mitigate the risk given the domain’s history and detection status. Users who have visited metamssk.io or interacted with its content should assume potential exposure to credential theft or crypto draining attempts. Immediate actions include revoking any connected wallet permissions, transferring assets to a new wallet with a fresh seed phrase, and monitoring for unauthorized transactions. System scans for malware are recommended, as interaction with such domains may lead to secondary infections. MetaMask users should verify domain authenticity through official channels before entering sensitive information and enable additional authentication layers where available.