qa[.]extension-metamask-wallet[.]com

This domain, qa.extension-metamask-wallet.com, is identified as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with legitimate MetaMask extension pages, likely for credential theft or wallet compromise. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and branding align with known credential harvesting tactics used in cryptocurrency phishing campaigns.

Technical indicators reveal the domain was registered on July 22, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolved to IP address 15.197.130.221, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. At the time of analysis, 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The domain lacked an SSL certificate, a common red flag for fraudulent sites. No detections were reported in Google Safe Browsing at the time of assessment.

The domain has since been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains for users who may have interacted with the site prior to its removal. Organizations and individuals are advised to monitor for unauthorized access to crypto wallets, revoke permissions for suspicious browser extensions, and verify domain authenticity before entering credentials. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.