i[.]nl-cionmrt[.]sbs

Analysis of the domain i.nl-cionmrt.sbs confirms its classification as a cryptocurrency scam targeting MetaMask users. The domain was registered on February 21, 2026, and has since been flagged by multiple security vendors. As of July 24, 2026, the domain is offline, but prior infrastructure analysis reveals it resolved to the IP address 172.67.153.219, hosted on Cloudflare's network (AS13335) in the United States. The domain appears on two security blocklists, and nine out of 93 security vendors on VirusTotal detected it as malicious, corroborating its fraudulent nature.

The domain's SSL certificate, issued by WE1, does not mitigate its risk, as phishing sites commonly use valid certificates to appear legitimate. Gridinsoft assigned a trust score of 0/100, further indicating its malicious intent. Detection engines such as PhishDestroy and ScamSniffer explicitly blocked this domain, classifying it as a crypto scam. While the exact content of the site remains unanalyzed, the available evidence—including the brand target (MetaMask) and scam type (crypto scam)—aligns with known tactics used to deceive users into divulging wallet credentials or transferring cryptocurrency.

Defenders should treat this domain as confirmed malicious infrastructure. Although it is currently offline, organizations should proactively block the domain and its associated IP address (172.67.153.219) at the network level. Security teams are advised to monitor for related domains registered under the same pattern or hosting provider, as threat actors frequently reuse infrastructure. If historical logs indicate user interaction with this domain, immediate incident response measures—such as credential rotation and wallet security reviews—are recommended for affected accounts.