metamask[.]io-airdrop[.]com

The domain metamask.io-airdrop.com is a cryptocurrency phishing site posing as a MetaMask brand impersonation. It specifically targets users with fake airdrop offers to harvest login credentials or sensitive wallet information, a tactic known as brand impersonation. No drainer kit was identified, and the site is currently taken offline, but it remains a verified scam domain.

Technical indicators confirm the malicious nature of metamask.io-airdrop.com. The domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through Name SRS AB on February 21, 2026, it resolves to the IP address 104.21.80.60, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by WE1, and the domain uses Cloudflare nameservers (nora.ns.cloudflare.com and toby.ns.cloudflare.com). Google Safe Browsing has not flagged the domain, but the creation date and blocklist presence align with typical phishing characteristics.

Users who interacted with metamask.io-airdrop.com should immediately change their MetaMask credentials and enable two-factor authentication if available. Monitor accounts for unauthorized transactions and report any suspicious activity to the legitimate MetaMask support team. Victims should also revoke any token approvals granted to unknown contracts using tools like Etherscan's token approval checker. Report the domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.