metamask[.]io-backupdevice[.]com

Analysis indicates that the domain metamask.io-backupdevice.com was created on 24 December 2025 and is currently taken offline. The domain resolves to IP address 185.100.87.82, which is announced as belonging to AS200651 FlokiNET ehf in Romania. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar often associated with minimal verification. The authoritative nameservers are ns1.ro1.imprezahost.com and ns2.ro1.imprezahost.com, further confirming Romanian hosting. No TLS certificate was observed, meaning the site served only over HTTP, a typical characteristic of low‑effort credential‑harvesting sites.

The page title returned by the server is “Secret Recovery Phrase”, and the threat intelligence tags the campaign as a Crypto Scam targeting MetaMask users. The associated phishing kit is identified as a “Recovery Scam”, which commonly attempts to trick victims into disclosing their wallet recovery seed. VirusTotal reports that 16 of 93 scanning engines flagged the domain, indicating a moderate level of consensus among security vendors. The domain appears on a single external blocklist and received a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment.

PhishDestroy has already blocked the domain. Given the combination of a brand‑specific page title, the absence of encryption, the Romanian hosting infrastructure, and the vendor detections, the domain should be treated as malicious. Defenders are advised to add the domain and its resolved IP address to network‑level deny lists, monitor for any resurgence of the same registrar or nameserver configuration, and educate end‑users about the risk of unsolicited requests for a MetaMask secret recovery phrase. Continuous monitoring of related subdomains and rapid takedown coordination with the registrar may further limit the campaign’s reach.