us02webzoon[.]top

This domain is identified as a brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet. The site is designed to deceive users into entering sensitive wallet credentials or seed phrases, enabling attackers to drain funds from connected accounts. Analysis indicates the domain operates as a crypto drainer, a type of attack that directly siphons cryptocurrency assets once authentication details are compromised. The threat is particularly severe due to the irreversible nature of blockchain transactions, which makes recovery of stolen funds nearly impossible. Evidence supporting the malicious classification includes detection by 4 out of 95 security vendors on VirusTotal, registration through PDR Ltd. d/b/a PublicDomainRegistry.com, and a creation date of February 21, 2026. The domain appears on three security blocklists and resolves to the IP address 144.124.229.60. A Gridinsoft trust score of 0/100 further corroborates its malicious intent. The infrastructure analysis reveals the domain was actively blocked by MetaMask, SEAL, and PhishDestroy, indicating prior recognition of its fraudulent activity. Users who visited us02webzoon.top or entered any credentials on the site should immediately disconnect the device from the internet to prevent further data exfiltration. All MetaMask wallet sessions should be terminated, and the wallet application should be reinstalled from the official source. Users must generate a new wallet and transfer all remaining assets to the new address, ensuring the compromised seed phrase is never reused. It is critical to review all connected applications and revoke any unauthorized access permissions. Monitoring for unusual transactions on the blockchain is recommended, and affected users should report the incident to relevant security teams for further analysis.