metamaskloginu[.]blogspot[.]md

This domain, metamaskloginu.blogspot.md, is flagged as an active crypto drainer phishing site targeting cryptocurrency wallet users. Infrastructure analysis reveals the domain resolves to IP address 142.251.127.132, which is associated with hosting services commonly exploited for malicious campaigns. As of July 19, 2026, the domain remains operational, with no evidence of takedown or mitigation efforts. Security vendor detections on VirusTotal indicate 9 of 95 engines classify this domain as malicious, though the specific signatures or heuristics triggering these alerts are not disclosed in available data. The domain's structure, incorporating 'metamasklogin,' suggests an intent to deceive users into believing they are accessing a legitimate MetaMask authentication portal, though the exact content or functionality of the site has not been analyzed. Defenders should prioritize blocking this domain at the DNS and network level to prevent potential credential theft or unauthorized cryptocurrency transactions. Monitoring for related subdomains or IP associations is recommended, as this infrastructure may be reused for additional phishing or malware distribution campaigns. The risk level is assessed as high due to the active status and direct targeting of cryptocurrency assets.