metta-io-mask[.]pages[.]dev

This domain, metta-io-mask.pages.dev, poses a targeted brand impersonation threat against MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site was designed to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys, under the pretense of account verification or security updates. The infrastructure and design elements closely resemble legitimate MetaMask interfaces, increasing the likelihood of successful social engineering attacks. Given the high-risk nature of cryptocurrency-related phishing, compromised credentials could lead to immediate and irreversible financial losses for victims, including unauthorized transfers of digital assets to attacker-controlled wallets.

Technical evidence confirms the malicious nature of this domain. The domain was registered on October 11, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.156, hosted on Cloudflare’s infrastructure (AS13335). Detection metrics reveal significant concern among security vendors, with 15 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has classified it as phishing. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimate services, though this is a common tactic in phishing campaigns to evade user suspicion. The page title, "Suspected phishing site | Cloudflare," suggests that Cloudflare’s internal detection mechanisms also identified the domain as fraudulent prior to its takedown.

Users who visited metta-io-mask.pages.dev or entered credentials on the site should assume their information has been compromised. Immediate actions include revoking access to any connected cryptocurrency wallets, generating new wallet addresses, and transferring remaining assets to a secure, unrelated wallet. Victims should also monitor their accounts for unauthorized transactions and enable multi-factor authentication on all related services. If recovery phrases or private keys were disclosed, the compromised wallet should be considered permanently at risk, and all associated funds should be moved to a new, secure wallet. Additionally, users are advised to report the incident to relevant financial and cybersecurity authorities to aid in tracking and mitigating further threats from this campaign.