metamaskwallet-restore[.]com

The domain metamaskwallet-restore.com was registered on February 21, 2026 through Dominet (HK) Limited and points to the IP address 195.250.27.134, which is attributed to WHG Hosting Services Ltd in Mexico (AS211126). The domain resolves using the nameservers cloud1.listedhosting.net and cloud2.listedhosting.net and serves an HTTPS certificate from Let’s Encrypt (R13). An HTTP request returns a 302 redirect, and the page title observed is “MetaMask: The Leading Crypto Wallet Platform, Blockchain Wallet,” directly referencing the MetaMask brand and indicating a crypto‑wallet impersonation. VirusTotal analysis shows 23 of 93 security vendors flag the domain, and the site appears on six security blocklists. Additional intelligence includes a Gridinsoft trust score of 0/100, inclusion in one AlienVault OTX pulse, and active blocking by PhishDestroy, MetaMask, SEAL, Polkadot, and Enkrypt. The current status is active, confirming ongoing threat exposure. While the page title and branding evidence establish a crypto‑scam intent, the specific content of the landing page, such as credential‑capture forms or malicious payloads, has not been publicly disclosed. Defenders should block the domain and its associated IP at the network perimeter, update intrusion‑detection signatures with the observed indicators, and monitor for any related activity targeting MetaMask users. Continuous re‑evaluation is recommended to capture any evolution of the site’s payload or infrastructure.