metamask-quest[.]xyz

This domain is classified as high-risk due to its role in brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. The infrastructure is designed to deceive users into disclosing sensitive credentials or authorizing malicious transactions, likely functioning as a crypto drainer or credential harvester. Analysis indicates the domain metamask-quest.xyz was registered through Nicnames, Inc. on February 21, 2026, and resolves to the IP address 45.89.67.146, hosted under AS209641 (I-SERVERS LTD) in Russia. The domain appears on three security blocklists and is flagged by 20 out of 95 security vendors on VirusTotal. No SSL certificate is present, and the page title identified during analysis was FASTPANEL, suggesting the use of a hosting control panel rather than a legitimate user-facing interface. The domain has since been taken offline but was previously blocked by multiple threat intelligence feeds. To mitigate risks associated with this type of brand impersonation, users should verify domain authenticity by cross-referencing official brand communications and avoiding interaction with unsolicited links. Organizations should monitor for similar domains registered through high-risk registrars and hosted on suspicious autonomous systems. Blocking known malicious IPs and domains at the network level, alongside implementing multi-factor authentication for crypto wallet access, reduces the likelihood of successful credential theft or unauthorized transactions. Security teams should also inspect logs for connections to 45.89.67.146 or related infrastructure.