unikoom[.]ru

The domain unikoom.ru has been assessed as an elevated risk site, specifically engaging in brand impersonation. This threat impersonates MetaMask, aiming to deceive users and potentially steal their credentials or private keys. The site was taken offline, but the risk remains due to its prior malicious activities and the potential for reappearance in a similar form.

Analysis indicates that the domain unikoom.ru is flagged by 5 out of 95 security vendors on VirusTotal, suggesting a low but significant detection rate. The domain is registered through RU-CENTER-RU, a registrar known for its association with various potentially malicious activities. Infrastructure analysis reveals that the domain resolves to the IP address 186.2.175.37, which has been linked to DDoS-Guard, a service often used to protect potentially malicious websites from takedown attempts. The domain was created on February 21, 2026, and has been listed on four security blocklists, including those maintained by MetaMask, SEAL, PhishDestroy, and OISD. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of trustworthiness. Additionally, the SSL certificate for unikoom.ru is issued by Let's Encrypt, a common practice among phishing sites to enhance credibility.

To mitigate the risks associated with this threat, users are advised to verify the URL and SSL certificate of any site that claims to be MetaMask or requests MetaMask-related information. Security solutions should be updated to include the latest blocklists and detection signatures. Organizations and individuals should also be cautious about links received via email or messaging platforms and report any suspicious activities to the appropriate security authorities or the MetaMask support team. Regularly monitoring and educating users about the latest phishing techniques can further reduce the likelihood of falling victim to similar scams.