prizepool[.]portfoliometamask[.]net

This domain, prizepool.portfoliometamask.net, is currently active and returns HTTP 200 responses. The site is listed as a crypto‑scam that impersonates the MetaMask wallet extension. It was registered on February 21 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the registrar‑provided nameservers ina1.registrar.eu, ina2.registrar.eu and ina3.registrar.eu. No TLS certificate is present, so the service is delivered over plain HTTP only.

The host resolves to 15.197.130.221, an address owned by Amazon.com, Inc. (AS16509) and located in the United States. Reputation services show a Gridinsoft trust score of 0 out of 100, and the domain is blocked by PhishDestroy and ScamSniffer as well as two additional security blocklists. VirusTotal analysis reports nine of ninety‑three scanning engines flagging the domain, reinforcing the malicious assessment. The page title observed is “portfoliometamask.net”, which matches the primary domain name and does not provide further context.

Because the page content has not been publicly disclosed, the exact mechanisms used to lure victims remain unknown, but the combination of brand impersonation, lack of encryption, and multiple blocklist listings indicates a high‑risk operation. Defenders should deny any outbound connections to this host, add the domain and its IP address to URL filtering and threat‑intel feeds, and monitor for related look‑alike domains. Continuous re‑evaluation is recommended as additional indicators, such as payload samples or phishing page screenshots, become available.