metamaskcare[.]com

Analysis indicates that metamaskcare.com was registered on June 22, 2026 through ENOM, INC. and is currently resolved to IP 23.254.253.187, an address owned by HostPapa (AS54290) in the United States. The domain uses the hostwindsdns.com name servers ns63.hostwindsdns.com and ns64.hostwindsdns.com and presents a valid Let's Encrypt TLS certificate. An HTTP GET returns status 200 with the page title “Google Chrome Can’t Find the Server,” suggesting the site may be serving a placeholder or error page rather than a visible phishing page at the time of observation. The domain is classified as a brand‑impersonation campaign targeting MetaMask and is listed on three public blocklists; it has been blocked by PhishDestroy, MetaMask’s own defenses, and SEAL. VirusTotal reports four detections out of ninety‑one scanners, reinforcing the malicious assessment. The risk level is marked high and the domain remains active. No additional technical artifacts such as malicious payloads, credential‑harvesting forms, or redirect chains have been disclosed, leaving the exact delivery mechanism uncertain. Defenders should proactively block the domain at DNS or firewall layers, continue monitoring its IP and DNS records for changes, and advise users to avoid any unsolicited links referencing MetaMask that resolve to this host. Adding the domain to internal blocklists and sharing the indicator with threat‑sharing communities will reduce exposure while further investigation is conducted.