cd3asdf[.]top

The domain cd3asdf.top is identified as a high-risk brand impersonation threat, specifically targeting MetaMask. The domain is currently active and continues to pose a significant risk to users.

Analysis indicates that the domain cd3asdf.top is flagged by 2 out of 95 security vendors on VirusTotal, highlighting a low but notable detection rate. The domain is registered through Dynadot LLC and resolves to the IP address 104.21.86.234, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain was created on May 28, 2026, and appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt, further complicating detection by providing a secure connection that may mislead users.

Given the current active status of cd3asdf.top, it is crucial to implement immediate defensive measures. Users and organizations are advised to block this domain at the network level and update security policies to include this threat. Additionally, educating users about the signs of brand impersonation and verifying the authenticity of MetaMask URLs can significantly mitigate the risk. Security teams should monitor this domain for any changes in infrastructure or detection rates and consider more advanced threat hunting techniques to identify related malicious activities.