metamasks[.]to

The domain metamasks.to was registered on May 19 2026 through NAMECHEAP and currently resolves to IP address 13.248.169.48 located in CA. It uses nameservers ns1.afternic.com and ns2.afternic.com along with an SSL certificate issued by GoDaddy TLS Intermediate CA DV R1. The domain returns an HTTP status code of 200 and remains active as of July 12 2026 while impersonating the MetaMask brand. This configuration matches patterns associated with brand impersonation threats that target cryptocurrency wallet users.

Infrastructure analysis reveals the domain appears in one AlienVault OTX pulse and is flagged by three out of 95 security vendors on VirusTotal. It also appears on two security blocklists with a Gridinsoft trust score of 0 out of 100. The combination of recent registration timing relative to the report date and the specific brand targeting supports classification as high-risk brand impersonation infrastructure.

Defenders should monitor the IP 13.248.169.48 and the listed nameservers for additional domains that may share the same hosting setup. Blocking or sinkholing the domain at the DNS level can limit exposure while reviewing logs for connections from internal systems. Continued observation is warranted because the domain status is confirmed active and the impersonation indicators remain consistent with the provided intelligence.

Uncertainties include the exact content served at the time of any user visit and whether additional subdomains or related domains exist under the same registration. Organizations should cross-reference internal telemetry against the exact IP and nameserver records rather than relying solely on domain strings. This approach allows precise identification of any active connections without assuming broader campaign scope.