mail[.]metamaskpayouts[.]io

This domain mail.metamaskpayouts.io resolves to IP 198.251.89.220 under AS53667 FranTech Solutions in the United States. Registration occurred on February 21 2026 via Global Domain Group LLC with nameservers ns27.asurahosting.com and ns28.asurahosting.com. The site uses LiteSpeed technology along with HTTP/3 and an SSL certificate from Let's Encrypt R13 while returning HTTP status 307 and presenting the page title Index of /. These elements establish the basic hosting and configuration profile tied directly to the reported infrastructure.

The domain is classified under brand impersonation targeting MetaMask in cryptocurrency operations. It is listed on one security blocklist and flagged by 11 of 95 vendors on VirusTotal. The status remains active with a high risk designation on the report date of July 12 2026. The page title and redirect behavior align with observed patterns for sites mimicking wallet or payout services in this category.

Uncertainties persist around the precise content served behind the directory index title and any direct linkage to specific campaign infrastructure beyond the known seed 634e72. No additional victim interaction data or payload details are available from the reported intelligence.

Defenders should incorporate the IP 198.251.89.220 and nameservers into monitoring and filtering rules. Cross referencing against existing blocklists including PhishDestroy is advised along with ongoing checks for resolution changes or certificate renewals. Regular review of traffic logs for connections to this domain supports timely isolation of related activity.