metamask[.]in[.]net

Analysis of the domain metamask.in.net indicates active brand impersonation targeting MetaMask, a cryptocurrency wallet service. The domain was registered through Cloudflare, Inc. (AS13335) and resolves to IP 172.67.173.119, located in the US. Infrastructure analysis reveals the use of Cloudflare nameservers (clayton.ns.cloudflare.com, melina.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The domain is flagged in 22 threat intelligence pulses on AlienVault OTX and appears on at least one security blocklist. The page title, 'SHBET ✔️ Link Đăng Ký Chính Thức Website SHBET.COM 2025,' does not match the expected MetaMask branding, suggesting either misdirection or a secondary scam purpose. Detected technologies include WordPress, MySQL, PHP, Bootstrap, jsDelivr, jQuery Migrate, jQuery, and HSTS. The domain returns an HTTP 301 redirect status, which may indicate an attempt to forward visitors to another malicious endpoint. Three of 95 security vendors on VirusTotal have flagged the domain, though the specific detection context is not provided. The domain is classified as a crypto scam and remains active as of July 12, 2026. Defenders should treat this domain as high-risk, block resolution at the DNS level, and monitor for related indicators of compromise. The mismatch between the advertised brand (MetaMask) and the observed page title (SHBET) suggests either a dual-purpose scam or an operational error, but the presence on multiple threat intelligence feeds confirms malicious intent.