meta-master-cwf[.]pages[.]dev

The domain meta-master-cwf.pages.dev has been identified as a potential brand impersonation threat targeting MetaMask. The domain was flagged for brand impersonation, indicating a high risk of users being misled into providing sensitive information such as login credentials or private keys.

Analysis indicates that the domain has been flagged by 16 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the cybersecurity community. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.45.29, which is located in the United States and operated by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, further lending a false sense of security to unsuspecting users. The domain was created on November 13, 2025, and it appears on 2 security blocklists, specifically PhishDestroy and PhishingDB.

The current status of the domain is offline, indicating that it has been taken down. However, the risk remains elevated as the domain and associated infrastructure could be reactivated. Security teams are advised to monitor for any signs of re-emergence and to ensure that users are educated about the dangers of visiting untrusted sites, especially those impersonating well-known brands like MetaMask. Additionally, implementing DNS-based blocking and regular scanning for similar suspicious domains can help mitigate the risk.