web-metamask[.]org

Analysis of the domain web-metamask.org indicates it was established as part of a crypto scam operation targeting MetaMask users. The domain was registered on February 21, 2026, and resolved to the IP address 209.182.216.3, hosted on AS36007 (Kamatera, Inc.) in the United States. At the time of investigation, the domain was offline, though it previously displayed the page title 'Jodale,' which does not correspond to known MetaMask branding or legitimate service identifiers. Infrastructure checks reveal the domain was flagged by 9 of 93 security vendors on VirusTotal, though this detection rate alone does not confirm the full scope of malicious activity.

It appeared on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed exposure in threat-sharing communities. The SSL certificate, identified as R10, is consistent with short-lived or low-trust issuances often associated with phishing infrastructure. The domain was blocked by PhishDestroy, a detection service specializing in brand impersonation, further supporting its classification as a MetaMask impersonation attempt.

Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk designation. While the exact content of the site remains unanalyzed, the combination of registration timing, hosting provider, detection coverage, and brand targeting aligns with known patterns of crypto-focused phishing campaigns. Defenders should treat this domain as confirmed malicious infrastructure and prioritize blocking or monitoring any residual DNS or network connections associated with 209.182.216.3 or the domain itself.