hub0g[.]signinpath[.]com

The domain hub0g.signinpath.com is identified as a high-risk brand impersonation threat targeting MetaMask. The domain is currently offline and has been taken down. This domain poses a significant risk of crypto theft and unauthorized access to user accounts.

Analysis of the domain reveals that it has been flagged by 15 out of 95 VirusTotal security vendors, indicating a notable level of suspicion among the cybersecurity community. The domain is registered through Squarespace Domains II LLC and resolves to the IP address 185.93.89.91, which is located in the Netherlands under the Limited Network LTD network. The domain was created on January 19, 2026, and has appeared on 4 security blocklists, further confirming its malicious intent. The SSL certificate is issued by Let's Encrypt, which, while legitimate, is commonly used by phishing sites due to its ease of acquisition.

Given the current offline status of the domain, users are advised to remain vigilant and report any suspicious activity to their respective security teams. Organizations should update their threat intelligence databases to include this domain and its associated IP address. Additionally, it is recommended to implement DNS-based blocking mechanisms and educate users on the risks of visiting unverified or suspicious domains, especially those impersonating trusted brands like MetaMask.