metamask[.]uk

This domain, metamask.uk, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the infrastructure was designed to deceive users into entering sensitive credentials, likely through a wallet drainer kit embedded in the phishing pages. The domain mimics legitimate MetaMask branding to facilitate unauthorized access to victims' digital assets, a tactic commonly observed in cryptocurrency-related fraud campaigns. Infrastructure analysis reveals the domain was registered on May 19, 2026, through the registrar Premkumar Veerabadran t/a sitekart. It resolves to the IP address 76.223.54.146, hosted on AWS Global Accelerator infrastructure located in the United States. The SSL certificate is issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV - R1v1), a common choice for both legitimate and malicious domains. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed, though it is not currently listed on Google Safe Browsing. As of the latest verification, metamask.uk has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure may remain dormant or be reactivated under a different domain or IP address. Users who interacted with the domain prior to its takedown should assume credential compromise and take immediate action, including revoking active sessions, transferring assets to a new wallet, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise to prevent future access attempts.