your-caio[.]com

Analysis of the domain your-caio.com shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was registered on 7 May 2026 via the registrar Spaceship, Inc., and immediately began serving a page titled “David Cartolano: AI Automation for Self‑Storage | Your CAIO”. The HTTP response is a 301 redirect, and the underlying host resolves to 188.114.97.3, a Cloudflare address located in Canada. DNS configuration uses Cloudflare name servers (lynn.ns.cloudflare.com, walk.ns.cloudflare.com) and the MX record points to an Outlook protection endpoint, indicating a potential malicious email relay. Infrastructure fingerprints reveal Amazon Web Services, Vercel, and Amazon S3 services, while HSTS is enforced and the TLS certificate is provided by Let’s Encrypt (E7). The domain is listed on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, yet it remains active at the time of this report. VirusTotal scans show four of ninety‑one scanners labeling the domain as malicious. The campaign employs an “Airdrop Scam” kit and explicitly impersonates the MetaMask brand, suggesting attempts to lure cryptocurrency wallet users with fraudulent airdrop offers. Defenders should block resolution to 188.114.97.3, deny outbound SMTP to the listed MX host, and add the domain to web‑filtering and endpoint protection rules. Continuous monitoring is advised because the site’s status may change, and further content analysis is required to confirm the exact phishing payload.