yomportal[.]com

The domain yomportal.com has been identified as an active brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. This domain was registered on June 18, 2026, and is currently active, posing significant risks to users who may inadvertently access it. The domain resolves to an IP address of 188.114.97.3, which is located in the United States and is part of Cloudflare, Inc.'s ASN (AS13335). Analysis reveals that the domain utilizes Cloudflare Browser Insights and HTTP/3, which are common technologies used by legitimate websites, but in this case, they are employed to mask the malicious intent and improve the site's performance and user experience, thereby increasing the likelihood of user engagement. The domain's current page title displays a '521: Web server is down' error, which could be an intentional tactic to test the waters or to avoid immediate detection while setting up the scam infrastructure. Despite the error, the domain is still accessible and has been flagged by one security vendor on VirusTotal, indicating a low but present level of suspicion among the broader security community. This domain is also blocked by PhishDestroy and SEAL, further corroborating its malicious nature. Defenders should be vigilant and monitor this domain for any changes in its infrastructure or content, as it is likely to be used in future impersonation attacks. Additionally, organizations and users should update their blocklists and security policies to include yomportal.com and educate their personnel about the risks associated with MetaMask impersonation scams. The use of reputable security solutions and regular checks for SSL certificates can help mitigate the risk of falling victim to such impersonation attacks.