h5[.]encryptglobal[.]net

This domain, h5.encryptglobal.net, is actively engaged in brand impersonation targeting MetaMask cryptocurrency wallet users. The infrastructure is designed to deceive users into entering sensitive credentials, including wallet seed phrases and private keys, by mimicking legitimate MetaMask authentication interfaces. The domain employs social engineering tactics, such as fake login prompts and urgent security alerts, to exploit user trust in the MetaMask brand. Given the high-value nature of cryptocurrency assets, successful compromise could result in immediate and irreversible financial loss for victims. Analysis indicates the domain was registered on December 26, 2025, through Global Domain Group LLC, and is hosted on IP address 151.243.109.128, located in the Netherlands under AS209274 (Kraken Network ISP LTD). The domain appears on three security blocklists, including PhishDestroy and SEAL, and is flagged by 3 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Let's Encrypt (R12), provides encryption but does not validate legitimacy, as malicious actors commonly exploit free certificate authorities to lend false credibility to phishing sites. The domain remains active as of this report, with no takedown or sinkholing observed. Users who have interacted with h5.encryptglobal.net should immediately revoke any entered credentials, particularly MetaMask seed phrases or private keys. Affected wallets must be migrated to new, secure instances using a clean device to prevent persistent access by threat actors. Network-level blocking of 151.243.109.128 and monitoring for connections to h5.encryptglobal.net is recommended for enterprise environments. Victims should also review transaction histories for unauthorized transfers and report the incident to relevant cryptocurrency abuse platforms for further tracking.