metamnt[.]com

Analysis of the domain metamnt.com shows it was created on April 24, 2026 and is currently active. The site returns HTTP 200 responses and presents a page titled “Metamnt - Welcome to NFT”. The SSL certificate is issued by Let’s Encrypt (R12) and the hosting resolves to IP 163.61.188.7, which is geolocated to the United States and attributed to an MIT‑associated network. The domain is registered through TuringSign Inc. d/b/a Cosmotown and uses four nameservers (dns1.lytehosting.com through dns4.lytehosting.com).

Infrastructure data indicate a very low Gridinsoft trust score of 1/100, and the domain appears on a single security blocklist. It has been flagged by PhishDestroy and referenced in one AlienVault OTX pulse. VirusTotal analysis shows a single positive detection out of 95 security vendors, reinforcing the suspicion of malicious activity despite the low detection count.

The observable evidence points to a classic generic phishing deployment that likely harvests credentials related to NFTs or cryptocurrency assets, given the page title. However, no specific phishing kit, payload, or victim interaction details are available in the current intelligence set, leaving the exact attack vector and target profile uncertain. The limited detection footprint suggests a possibly early‑stage campaign or a low‑volume operation.

Defenders should prioritize blocking metamnt.com at the DNS and proxy layers, and add the resolving IP address 163.61.188.7 to outbound deny lists. Email security gateways should be tuned to inspect messages referencing NFT‑related branding, and any URLs matching the observed page title should be quarantined. Continuous monitoring of the domain’s DNS changes and additional threat feeds is recommended to capture any escalation or expansion of the campaign.