web-mets-mask-logiin-us[.]pages[.]dev

The domain web-mets-mask-logiin-us.pages.dev has been identified as a high-risk brand impersonation site targeting the cryptocurrency wallet MetaMask. The site aims to deceive users by mimicking the legitimate MetaMask login page, potentially leading to the theft of private keys and other sensitive information.

Analysis indicates that the domain has been flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection among security tools. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.46.208, which is located in the United States and is part of AS13335, Cloudflare, Inc. The domain was created on October 30, 2025, and appears on three security blocklists. The page title, 'Metamask Login ensures safety, ease of use,' is designed to instill a false sense of security in users. The domain has a valid SSL certificate issued by Google Trust Services / WE1, which may further contribute to user trust.

As of the latest assessment, the domain is currently offline. Despite this, it remains important for users to remain vigilant and avoid accessing the site if it becomes active again. Security researchers recommend that relevant parties, including MetaMask, continue to monitor the domain for any signs of reactivation. Given the domain's offline status and the presence of the SSL certificate, the remaining risk is reduced but not eliminated, and users should be cautious and verify the authenticity of any MetaMask login pages they encounter.