ccptrump[.]xyz

This domain poses a significant threat through brand impersonation, specifically targeting MetaMask, a widely used cryptocurrency wallet. By mimicking the legitimate MetaMask website, the domain aims to deceive users into divulging sensitive information such as login credentials and private keys, which can lead to financial loss and unauthorized access to user accounts.

Analysis indicates that ccptrump.xyz is flagged by 14 out of 95 security vendors on VirusTotal, suggesting a high level of suspicion among cybersecurity professionals. The domain was created on May 17, 2026, and is registered through Namecheap, a common registrar for malicious domains. The infrastructure analysis reveals that the domain resolves to the IP address 34.111.179.208 and utilizes technologies such as Google Cloud, HSTS, Google Cloud Trace, and Google Cloud CDN, which can enhance the credibility of the phishing site. Additionally, the domain has an SSL certificate issued by Let's Encrypt, further complicating detection by less sophisticated users.

If a user has visited this domain, it is crucial to take immediate action to secure their MetaMask wallet and other related accounts. First, change the MetaMask password and enable two-factor authentication (2FA) if not already done. Monitor account activity for any unauthorized transactions and report any suspicious activity to the MetaMask support team. Finally, update security software to ensure protection against similar threats and avoid clicking on links from unknown sources in the future.