metamaskauth[.]yzz[.]me

This domain, metamaskauth.yzz.me, operates as a crypto drainer, a type of phishing infrastructure designed to deceive users into connecting their cryptocurrency wallets. Once connected, malicious scripts automatically execute unauthorized transactions, draining funds from the victim’s wallet without consent. The threat primarily targets users of decentralized finance (DeFi) platforms and wallet extensions, exploiting trust in seemingly legitimate authentication prompts. Analysis indicates the domain was registered on August 07, 2022, through Porkbun LLC, and currently resolves to the IP address 185.27.134.34. As of the latest assessment, 12 out of 95 security vendors on VirusTotal have flagged the domain as malicious, confirming its active use in fraudulent campaigns. The domain remains operational, suggesting ongoing exploitation attempts. If a user has interacted with metamaskauth.yzz.me, immediate action is required. First, revoke any wallet connections or permissions granted to the domain via the wallet’s settings interface. Next, transfer remaining assets to a new, secure wallet address not previously exposed to the malicious site. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain security platforms for further investigation. Users should also scan their devices for malware, as crypto drainers may deploy additional payloads to maintain persistence.