metamaak-leggin[.]gr[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet. The site mimics the official MetaMask login interface to deceive users into entering sensitive credentials, including private keys or seed phrases, which could result in unauthorized access to digital assets and financial loss. Analysis indicates the domain metamaak-leggin.gr.com is currently active and resolves to IP address 172.67.177.184, hosted on Cloudflare infrastructure (AS13335). It appears on one security blocklist and is flagged by 8 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), and the domain is registered through Key-Systems GmbH. The page title, 'Metamask login - Web3 wallet for ETH, SOL, swaps and 50x perps,' closely mirrors legitimate MetaMask branding to enhance credibility. Mitigation steps for this threat include immediate blocking of the domain and IP address across network security controls. Organizations should update endpoint protection rules to detect and prevent access to the domain. Users should be educated to verify the URL before entering credentials, ensuring it matches the official MetaMask domain (metamask.io). Multi-factor authentication (MFA) should be enforced where possible to add an additional layer of security. Monitoring for unusual login attempts or transactions linked to this domain is recommended to detect potential compromise.