portfolio[.]metamask[.]en-eu[.]io

This domain, portfolio.metamask.en-eu.io, operates as a credential harvesting platform targeting users of the MetaMask cryptocurrency wallet. Analysis indicates the site was designed to mimic legitimate MetaMask interfaces, tricking victims into entering private keys or recovery phrases, which are then exfiltrated to attacker-controlled infrastructure. The threat extends to potential financial loss, as compromised wallets can be drained of assets without further user interaction. Infrastructure analysis reveals the domain was registered on January 29, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 217.160.0.232 and is flagged by 15 out of 95 security vendors on VirusTotal for phishing or brand impersonation. The domain appears on three distinct security blocklists, further corroborating its malicious nature. The SSL certificate, issued by Sectigo Limited, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who visited portfolio.metamask.en-eu.io or entered sensitive information should immediately revoke access to any connected wallets and transfer assets to a new, secure wallet. All credentials, including recovery phrases, should be considered compromised and never reused. Monitoring for unauthorized transactions and enabling multi-factor authentication on all accounts is strongly advised. If the wallet was accessed via this domain, a full system scan for malware is recommended to detect potential secondary infections.