iscanx[.]top

This domain, iscanx.top, is identified as an active high-risk phishing infrastructure specifically targeting users of MetaMask, a widely used cryptocurrency wallet. The threat type is classified as brand impersonation, with the domain presenting itself as a legitimate multi-chain portfolio tracker under the page title 'SolRay — Multi-Chain Portfolio Tracker.' The intent is to deceive users into divulging sensitive wallet credentials or private keys, facilitating unauthorized access to cryptocurrency assets. Analysis of the domain reveals multiple technical indicators of malicious activity. iscanx.top was registered on April 25, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive domains. The domain lacks an SSL certificate, increasing the likelihood of unencrypted data interception. It resolves to the IP address 188.114.96.3, which has been flagged by 9 of 95 security vendors on VirusTotal for hosting phishing content. Additionally, the domain appears on three distinct security blocklists, further corroborating its malicious nature. The absence of legitimate infrastructure, combined with the use of a deceptive page title, underscores the calculated effort to mimic trusted services. As of the latest assessment, iscanx.top remains active and poses a significant risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include the IP address 188.114.96.3. Users who may have interacted with the domain should immediately revoke any permissions granted to associated applications, rotate wallet credentials, and monitor accounts for unauthorized transactions. Security teams are encouraged to correlate this domain with other known MetaMask impersonation campaigns to identify broader patterns of abuse.