investalog-88zn[.]vercel[.]app

PhishDestroy identifies investalog-88zn.vercel.app as an active MetaMask brand impersonation domain designed for credential theft. The threat actor registered this domain via Vercel Inc., hosted it behind a fraudulent MetaMask Login page, and configured it to resolve to IP 216.198.79.67. The aim is to trick users into surrendering their wallet recovery phrases or private keys under the guise of a legitimate login portal, enabling cryptocurrency asset theft and account takeover. InvestDestroy’s telemetry and third-party intelligence confirm an elevated risk profile: VirusTotal reports detections by nineteen of ninety-five participating security vendors, while Google Safe Browsing has already flagged the site for social engineering. Domain creation occurred recently under the Vercel platform, a common choice for phishing operators seeking fast, free, and abusable hosting. The presence of a Google Trust Services SSL certificate lends superficial legitimacy, potentially lowering user suspicion during credential entry. Users who visited investalog-88zn.vercel.app and entered any MetaMask-related information should immediately revoke all connected wallet permissions using MetaMask’s Security & Privacy settings or revoke site permissions via the official MetaMask mobile or browser extension. Next, transfer any remaining assets to a newly generated wallet address and perform a full device malware scan. Report the domain to MetaMask’s phishing inbox at security@metamask.io and consider filing a complaint with the FBI IC3 portal at ic3.gov. Finally, rotate all passwords stored in the affected browser and enable two-factor authentication on every connected account.