qzlabzx[.]click

This domain, qzlabzx.click, is identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site was designed to mimic legitimate MetaMask interfaces, likely to deceive users into disclosing sensitive credentials or authorizing unauthorized transactions. The page title, QUARK TEST, suggests either a staging environment or a placeholder used during the development of a wallet-draining kit, which is consistent with observed tactics in cryptocurrency phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 3 out of 95 security vendors on VirusTotal, and it appears on two independent security blocklists. It was registered through Web Commerce Communications Limited on August 3, 2025, and resolves to the IP address 104.21.64.1. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of legitimacy. Additionally, the domain has been actively blocked by at least two security platforms specializing in phishing and scam detection. As of the latest assessment, qzlabzx.click has been taken offline, reducing immediate exposure to potential victims. However, the underlying infrastructure may still pose residual risks, particularly if the same threat actors reuse the IP address, registrar, or associated hosting providers for future campaigns. Users who interacted with this domain prior to its takedown should immediately revoke any active wallet authorizations, monitor transaction histories for unauthorized activity, and consider rotating credentials for any associated accounts. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts.