metamaskloeegin[.]w3spaces[.]com

The domain metamaskloeegin.w3spaces.com is flagged as a high-risk brand impersonation threat targeting MetaMask, a popular cryptocurrency wallet. This domain was likely used to deceive users into believing they were interacting with a legitimate MetaMask service, potentially leading to credential theft or other malicious activities.

Infrastructure analysis reveals that this domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain is registered through Amazon Registrar, Inc., and resolves to the IPv6 address 2600:9000:2156:5c00:b:df74:43c0:93a1, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The domain was created on December 21, 2020, and currently appears on 3 security blocklists, including PhishDestroy, Enkrypt, and PhishingDB. The SSL certificate is issued by Amazon and is an RSA 2048-bit certificate, which may have been used to add a layer of trust to the deceptive site.

The domain is currently offline, and the page title now reads '404 - Not found | W3 Spaces'. Despite the domain being taken down, the infrastructure and historical data suggest that the threat actors may attempt to reuse similar tactics. Users are advised to remain vigilant and avoid clicking on links or entering credentials on any unfamiliar or suspicious websites, especially those purporting to be MetaMask or other trusted services. Security teams should monitor for similar domain patterns and ensure that endpoints are protected against known malicious indicators.