metamask[.]bitcoin[.]ec[.]cc

PhishDestroy identifies metamask.bitcoin.ec.cc as an active brand impersonation domain targeting MetaMask users. The domain mimics the legitimate MetaMask brand to deceive victims into connecting crypto wallets or entering seed phrases, enabling crypto drainer activity. While no specific drainer kit payloads were detected in this investigation, the domain’s structure and naming convention strongly suggest credential theft mechanisms typical of crypto phishing campaigns. This domain exhibits several red flags aligned with fraudulent infrastructure. Registered on October 13, 1997, through Gname.com Pte. Ltd., it resolves to IP address 102.134.35.21 and is secured with a Let’s Encrypt SSL certificate. VirusTotal currently returns a clean scan result of 4/95 detections, though this reflects only initial scanning coverage and does not confirm safety. No blocklist entries were reported at the time of analysis, and Google Safe Browsing (GSB) status remains unflagged. The domain’s age (over 25 years) is anomalous and suggests either domain squatting or long-term dormant infrastructure later repurposed for malicious use. Current status indicates active threat potential with medium operational risk due to low detection coverage. PhishDestroy has flagged this domain for immediate classification and dissemination. Users are advised to block access at the network level and report the domain to hosting providers and security vendors. Remaining risk is elevated due to the lack of detection coverage and absence from blocklists, warranting heightened monitoring. Organizations should update firewall rules and DNS blacklists to include this domain using indicators: metamask.bitcoin.ec.cc, 102.134.35.21.