green-x[.]xyz

This domain, green-x.xyz, is flagged for brand impersonation targeting MetaMask, a cryptocurrency wallet service. The site presents a fraudulent "MetaMask - Import Wallet" interface designed to deceive users into entering sensitive credentials, such as seed phrases or private keys. Such impersonation typically facilitates cryptocurrency theft, where attackers gain unauthorized access to victims' wallets and drain funds. The page title and structure closely mimic legitimate MetaMask onboarding flows, increasing the likelihood of successful social engineering attacks against less technical users or those under time pressure. Analysis indicates the domain exhibits multiple high-risk indicators. It is detected by 16 out of 95 security vendors on VirusTotal, reflecting moderate but concerning consensus among threat intelligence sources. The domain was registered on September 21, 2025, through Spaceship, Inc., a registrar with a history of hosting malicious infrastructure. It resolves to the IP address 188.114.96.3, geolocated to Canada and associated with CloudFlare, Inc., a common CDN provider leveraged to obscure origin servers. The domain appears on one security blocklist and lacks an SSL certificate, further signaling its illegitimate nature. Infrastructure analysis reveals no legitimate association with MetaMask or its parent entities. Users who visited green-x.xyz or interacted with its content should assume compromise of any entered credentials. Immediate actions include revoking access to any linked wallets, generating new private keys, and transferring remaining assets to a secure, unrelated wallet. Monitor transaction histories for unauthorized activity and report the incident to relevant cryptocurrency platforms. Avoid reusing passwords or seed phrases across services. Organizations should update blocklists to include this domain and its resolving IP, while security teams may investigate further for lateral movement or secondary infections tied to this campaign.