the-disq[.]ru

The domain the-disq.ru has been identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. This domain is currently offline, though prior analysis indicates it was actively used to deceive users into disclosing sensitive wallet credentials or authorizing malicious transactions under the guise of legitimate MetaMask operations. The threat type is classified as brand impersonation with potential secondary objectives including crypto asset drainage or credential theft. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure ownership and operational details. The domain resolves to the IPv6 address 2606:4700:3036::6815:5649, hosted on infrastructure associated with Cloudflare services. Detection metrics indicate the domain was flagged by 3 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100, reflecting high confidence in its malicious nature. The domain appears on a single security blocklist and was actively blocked by PhishDestroy. The page title, "Ubeswap обзор: Полный анализ проекта," suggests an attempt to masquerade as a cryptocurrency project review, likely to lend credibility to the phishing operation. Current status confirms the domain has been taken offline, though the underlying infrastructure may remain accessible for future malicious campaigns. Users who interacted with the domain are advised to immediately revoke any wallet authorizations granted during the suspected compromise period. Security teams should monitor for residual connections to the identified IPv6 address and registrar patterns associated with Cloudflare registrations. Proactive measures include deploying network-level blocks for the resolved IP and implementing real-time detection rules for domains impersonating cryptocurrency services. Organizations handling digital assets should enforce multi-factor authentication and transaction verification protocols to mitigate risks from similar brand impersonation threats.