b-group[.]trade

This domain, b-group.trade, is actively flagged as a high-risk brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Registered on April 28, 2026, through NameSilo, LLC, the domain resolves to IP address 172.67.158.110, which is associated with Cloudflare infrastructure. Analysis indicates the use of React and Cloudflare Browser Insights, alongside HTTP/3, suggesting a modern web stack designed to evade detection or enhance performance. The SSL certificate is issued by Google Trust Services, a common choice for both legitimate and malicious domains. The domain appears in 23 threat intelligence pulses on AlienVault OTX, and is blocked by at least four security blocklists, including SEAL, MetaMask's internal systems, PhishDestroy, and BLP-Malware. Gridinsoft assigns a trust score of 0/100, while Scamadviser provides a marginally higher score of 46/100, reflecting inconsistent but generally negative reputation signals. Five of 95 security vendors on VirusTotal flag the domain as malicious, though the absence of detections from the remaining vendors does not confirm safety. The page title, 'Bourso Group,' does not align with the targeted brand, MetaMask, which may indicate an attempt to obfuscate the domain's true purpose or a secondary layer of deception. The domain remains active as of July 12, 2026, and defenders should treat it as a confirmed phishing asset. Recommended actions include blocking the domain and its resolving IP at the network perimeter, monitoring for related infrastructure (e.g., subdomains or newly registered lookalike domains), and alerting users to the impersonation risk. Further investigation into the hosting provider and registrar may reveal additional linked domains or campaigns.