web-metamask[.]to

This domain is flagged as an elevated-risk credential harvesting and brand impersonation threat targeting MetaMask cryptocurrency wallet users. Analysis indicates the site is designed to deceive visitors into disclosing sensitive wallet credentials, recovery phrases, or private keys under the pretense of providing legitimate MetaMask services. The page title, 'MetaMask: Your Gateway to Decentralized Finance Wallets,' closely mimics the official branding, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking wallet access or support. Infrastructure analysis reveals the following technical indicators: the domain web-metamask.to was registered on August 19, 2025, through the Government of Kingdom of Tonga registrar. It resolves to the IP address 95.129.233.245, which is geolocated in Russia and associated with AS57724 (DDOS-GUARD LTD). The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (R13), a common tactic to lend superficial legitimacy to phishing sites. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, with a consensus classification of brand impersonation and credential theft. Mitigation against this specific threat type requires immediate user awareness and infrastructure-level protections. Users who may have interacted with web-metamask.to should assume their wallet credentials or recovery phrases are compromised and take urgent steps to secure their assets. This includes transferring funds to a new wallet, revoking any connected dApp authorizations, and monitoring for unauthorized transactions. Organizations and security teams should update blocklists to include the domain and its associated IP address 95.129.233.245. Network-level protections should be implemented to prevent resolution of this domain and similar impersonation attempts. Given the domain's registration under a less common registrar and hosting behind a bulletproof provider, continued vigilance is advised for related infrastructure reuse in future campaigns.