torontonmks[.]co

Analysis of the domain torontonmks.co indicates that it is a high-risk brand impersonation site targeting MetaMask. The domain was registered on December 10, 2025, through Gname.com Pte. Ltd. and has been flagged as a crypto scam by security vendors. The page title for this site is 'MetaMaskCo,' which closely mimics the legitimate MetaMask brand. The domain currently resolves to the IP address 188.114.97.3, which is hosted in the United States under the ASN AS13335, belonging to Cloudflare, Inc. As of the report date on July 25, 2026, the domain is offline and has been taken down.

It is also listed on one security blocklist, specifically PhishDestroy, which further corroborates its malicious nature. The domain does not have an SSL certificate, which is a common indicator of a non-secure and potentially fraudulent site. Although the domain is offline, the infrastructure and historical data suggest that it was used to deceive users into believing it was a legitimate MetaMask site, likely to steal cryptocurrency or sensitive information.

Defenders should remain vigilant and monitor for any resurrection of this domain. Additionally, it is advised to review any systems that may have interacted with this domain during its active period and to ensure that users are educated about the dangers of visiting unverified sites, especially those impersonating trusted brands like MetaMask. The domain's offline status and blocklist presence indicate that it has been successfully mitigated, but the risk of similar impersonation attacks persists.