metamaskprotect[.]com

Analysis indicates that metamaskprotect.com was registered on March 07, 2026 through NiceNIC International Group Co., Limited and hosted on the IP address 158.94.210.251, which belongs to AS202412 Omegatech LTD in the Netherlands. The site presented the page title “MetaMask - Insure Your Wallet”, directly referencing the MetaMask brand, and is classified as a crypto‑scam that impersonates MetaMask. No TLS certificate was observed, leaving the HTTP connection unencrypted. The domain appears on three independent blocklists, and it has been actively blocked by the PhishDestroy, MetaMask, and SEAL mitigation services.

VirusTotal reports that eleven of ninety‑four scanning engines flagged the domain, reinforcing the malicious assessment. The authoritative nameservers are helium.ns.hetzner.de, hydrogen.ns.hetzner.com, and oxygen.ns.hetzner.com, all belonging to the Hetzner hosting provider. As of the report date, the site is taken offline, but the underlying infrastructure remains allocated. The offline status does not guarantee cessation of malicious activity, as threat actors often reactivate or clone the domain after a short interval.

Defenders should immediately add metamaskprotect.com to domain deny lists and enforce DNS‑based blocking for the associated IP range. Monitoring of the hosting provider’s subnet and the Hetzner nameserver set is advised to detect potential re‑use of the same infrastructure for new impersonation attempts. Continuous review of threat‑intel feeds for additional references to the same IP or similar brand‑impersonation campaigns is recommended, and any inbound traffic to the IP should be logged and inspected for anomalous activity.